An OS Command Injection flaw exists in the firmware of TP‑Link Archer BE230 routers running version 1.2. Attackers who are authenticated and have local network proximity can submit malicious input that the device passes to the operating system shell. The flaw allows execution of arbitrary shell commands and, as reported, can give full administrative control over the device. This leads to loss of configuration integrity, network security and service availability. The weakness is a classic OS command injection (CWE‑78).

TP‑Link Systems Inc. sells the Archer BE230 router. The vulnerability affects firmware versions 1.2 and 1.20 up to, but not including, Archer BE230 v1.2.4 (Build 20251218 rel.70420). No other versions are impacted.

With a CVSS score of 8.5 the flaw is considered high severity, yet the EPSS suggests that exploitation attempts are exceedingly rare at present. The attacker must be authenticated to the device and capable of sending crafted input, typically via a locally connected user. The absence from the KEV catalog indicates no known active exploitation. Still, the potential to gain complete administrative control warrants immediate mitigation.