A command injection flaw exists in the DHCP option parsing logic of several TP‑Link routers, caused by insufficient input validation of externally supplied DHCP option data. An attacker who can send crafted DHCP responses while the device is in a factory‑default or otherwise unconfigured state can execute arbitrary shell commands with elevated privileges. Successful exploitation would give the attacker full administrative control over the device, enabling complete compromise of the router and any network resources it manages.

The vulnerability affects multiple TP‑Link models, including Archer MR402 v1, Archer C20 v5 and v6, Archer MR200 v07 and v8, Archer VR2100 v1, and TL‑MR6400 v7. These devices process DHCP traffic during initial setup or provisioning, making the flaw relevant to the listed firmware releases.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the attack is likely to be mounted by an adjacent, unauthenticated adversary who can influence the DHCP traffic the router receives. Because the flaw is exploitable during the brief factory‑default period, the window of opportunity is narrow yet potentially critical, especially in environments where an untrusted device can be connected to the network during provisioning or in point‑of‑sale scenarios.