An OS command injection flaw exists in the web modules of TP‑Link Archer BE230 v1.2 and Archer AXE75 v1.0. The flaw allows an authenticated user to inject arbitrary operating‑system commands. Successful exploitation can give the attacker full administrative control, allowing configuration tampering, network compromise, and potential denial of service.

The vulnerability affects TP‑Link Archer BE230 version series up to and including 1.2.3 Build 20251218 rel.70420, and Archer AXE75 up to 1.4.x, specifically versions preceding 1.5.3 Build 20260209 rel.71108. Both products are listed under TP Link Systems Inc. in the CNA data.

With a CVSS score of 8.5 the vulnerability is high severity, yet the EPSS score is below 1%, indicating a low current exploitation probability. The flaw requires an authenticated session, so only users with local network access who can log into the router’s web interface can leverage it. It is not listed in the CISA KEV catalog, but organizations that expose the management interface to the broader network should consider the risk higher. The likely attack vector is an authenticated attacker within the router’s management interface.