An authenticated OS command injection exists in the Offline Download component of the Archer AX3000 v2. When a USB storage device is attached, an administrator can submit a crafted path containing shell metacharacters that is not properly sanitized before being passed to a system command. Successful exploitation allows the attacker to execute arbitrary commands on the device, compromising its integrity and potentially the network it connects to.

TP‑Link Systems, Archer AX3000 v2. The vulnerability affects the device’s offline download feature that handles USB storage allocation. No additional specific firmware revisions are listed beyond the general “v2” designation.

The CVSS score is 7.3, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local authenticated administrator who plugs a USB device into the router and submits a malicious path. Successful exploitation grants the attacker the ability to run arbitrary commands on the device.