The vulnerability arises from improper sanitization of input in a modem‑management administrative CLI command. An attacker who is already authenticated with administrative privileges can supply specially crafted data that is passed directly to the underlying operating system shell. This results in arbitrary OS command execution, which can lead to compromise of confidentiality, integrity and availability of the device.

The affected devices are TP‑Link Archer model series manufactured by TP‑Link Systems Inc. The vulnerable firmware versions are Archer NX200 v1.0, v2.0, v2.20 and v3.0; Archer NX210 v2.0, v2.20 and v3.0; Archer NX500 v1.0 and v2.0; and Archer NX600 v1.0, v2.0 and v3.0. Firmware updates or newer releases beyond these versions are not listed as affected.

The CVSS score of 8.5 signals high severity. The EPSS score of less than 1% indicates that exploitation likelihood is presently low, and the vulnerability is not catalogued in CISA’s KEV list. Because the flaw requires local or remote access to the modem management CLI with administrative rights, an attacker who has breached local network control or obtained credentials could execute arbitrary commands, blowing away system integrity and potentially allowing further lateral movement. Organizations should assess whether their networks expose the management interface to untrusted networks and enforce strict access controls.