An OS Command Injection flaw exists in the VPN modules of TP‑Link Archer BE230 firmware 1.2, allowing an authenticated attacker within the local network to execute arbitrary shell commands. The attacker could obtain full administrative control, which can compromise the device’s configuration, disrupt network traffic, and potentially expose sensitive information. This vulnerability is classified as CWE‑78, indicating that untrusted input is passed to the operating system for execution without proper sanitization.

The flaw affects TP‑Link Systems Inc. Archer BE230 routers running firmware version 1.2 and any subsequent 1.2.x release up to but not including 1.2.4 (Build 20251218 rel.70420). Devices with older or unpatched firmware in this range are vulnerable.

The CVSS base score of 8.5 marks this issue as highly severe. The EPSS score is below 1%, suggesting a low current exploitation rate, and the vulnerability is not listed in CISA’s KEV catalog. Attack requires local or adjacent authenticated access, and while no public exploit has been reported, the presence of a command injection vector means any compromised account can elevate privileges or trigger arbitrary code execution.