The vulnerability is an OS command injection in the web modules of TP‑Link Archer BE230 v1.2. An attacker who has authenticated on a network adjacent to the device can trigger the injection by passing specially crafted input to the firmware. The injection allows arbitrary operating‑system commands to run with root privileges on the device. Successful exploitation would grant the attacker full administrative control, enabling configuration tampering, denial‑of‑service, and covert network monitoring.

TP‑Link Archer BE230 “v1.2” routers running firmware builds older than 1.2.4 (build 20251218 rel.70420). Any router identified as TP‑Link Systems Inc. Archer BE230 v1.2 in the specified firmware family is susceptible.

The vulnerability scores as a high‑severity CVSS 8.5, yet the EPSS score is under 1 %, indicating a low current exploitation likelihood. It is not listed in CISA’s KEV catalog. The exploit requires the attacker to have authenticated access from a nearby network segment, which is a common scenario for devices exposed on untrusted networks. If exploited, the attacker can execute arbitrary commands that could lead to full device takeover, exposing sensitive routing data and potentially pivoting into connected systems.