An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP‑Link Archer BE230 v1.2, BE3600 v1 and AXE75 v1, allowing an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.

TP‑Link Systems Inc. sells Archer BE230, BE3600, and AXE75 routers. The vulnerability affects Archer BE230 firmware version 1.2 up to, but not including, 1.2.4 (Build 20251218 rel.70420), Archer BE3600 firmware v1, and Archer AXE75 firmware v1 up to, but not including, v1.5.6 (Build 20260623). No other versions are impacted.

With a CVSS score of 8.5 the flaw is considered high severity, yet the EPSS score of 2% indicates that exploitation attempts are rare at present. The attacker must be authenticated to the device and capable of sending crafted input, typically via a locally connected user. The absence from the KEV catalog indicates no known active exploitation. Still, the potential to gain complete administrative control warrants immediate mitigation.