A command injection flaw exists in the VPN Connection Service of certain TP‑Link routers, allowing an authenticated administrator to run arbitrary operating‑system commands with full device privileges. This weakness can compromise the configuration integrity, network security, and overall availability of the affected network device. The vulnerability is classified as an OS command injection (CWE‑78). Based on the description, the vulnerability can be exploited only after an attacker obtains administrative credentials to the router’s management interface.

The vulnerability affects TP‑Link Archer BE230 firmware versions earlier than 1.2.4 Build 20251218 rel.70420 and TP‑Link Archer AX53 firmware versions earlier than 1.5.3 Build 20260209 rel.71108, as identified by vendor listings. No other models are explicitly mentioned in the official advisory.

The CVSS score of 8.5 indicates high severity, while the EPSS score is reported as less than 1 % and the flaw is not listed in CISA’s KEV catalog, suggesting that exploitation in the wild is currently low. Attackers who possess or compromise administrator credentials can exploit the VPN Connection Service to execute commands with system privileges, effectively taking over the device. The risk remains high if administrative access can be obtained, but the likelihood of a public attack appears low at this time.