An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP‑Link Archer BE230 v1.2, BE3600 v1, AX10 v3 and AXE75 v1. The flaw allows an adjacent authenticated attacker to execute arbitrary code, potentially granting full administrative control over the device. Successful exploitation could compromise configuration integrity, network security, and service availability. The issue affects Archer BE230 firmware version 1.2 up to, but not including, 1.2.4 (Build 20251218 rel.70420) and Archer AXE75 firmware v1 up to, but not including, v1.5.6 (Build 20260623).

TP‑Link Systems Inc. sells Archer BE230, BE3600, AX10 and AXE75 routers. The vulnerability affects Archer BE230 firmware version 1.2 up to, but not including, 1.2.4 (Build 20251218 rel.70420), Archer AXE75 firmware v1 up to, but not including, v1.5.6 (Build 20260623), Archer BE3600 v1, and Archer AX10 v3. No other versions are affected.

With a CVSS score of 8.5 the flaw is considered high severity, yet the EPSS score of 1.6% indicates that exploitation attempts are rare at present. The attacker must be authenticated to the device and capable of sending crafted input, typically via a locally connected user. The absence from the KEV catalog indicates no known active exploitation. Still, the potential to gain complete administrative control warrants immediate mitigation.