A command injection flaw exists in the cloud communication interface of TP‑Link Archer BE230 firmware v1.2. The vulnerability permits an authenticated administrator to inject arbitrary OS commands once authenticated. Successful exploitation would give an attacker full administrative control, allowing the attacker to modify configuration settings, disrupt network operations, and disable services, resulting in a comprehensive compromise of the device.

TP‑Link Archer BE230, firmware versions earlier than 1.2.4 (Build 20251218). The flaw is present in the v1.2 release and any earlier builds, affecting all models marketed under the Archer BE230 name.

The vulnerability has a CVSS score of 8.5, indicating high severity. Its EPSS score is below 1% and it is not listed in the CISA KEV catalog, suggesting a low current exploitation probability but still a real risk. Attackers require administrative credentials to the cloud interface; once authenticated, they can execute shell commands. Because the flaw resides in a privileged interface, the attack surface is limited to administratively accessible sessions, yet the impact is full device takeover.