A command injection flaw exists in the configuration backup restoration function of the TP-Link Archer BE230. After an admin authenticates, an attacker can inject arbitrary shell commands, gaining full administrative control of the device. The vulnerability allows manipulation of configuration integrity, compromise of network security, and disruption of service availability.

TP-Link Archer BE230, firmware versions prior to 1.2.4 (Build 20251218 rel.70420). The affected product is the Archer BE230 model running firmware v1.2 and lower up to but not including 1.2.4.

The CVSS score of 8.5 rates this as a high‑impact vulnerability. Attackers need authenticated access to the router’s admin interface, which typically requires valid admin credentials or default credentials still in use. The EPSS score of less than 1% suggests that exploitation is currently uncommon but not impossible. The vulnerability is not listed in the CISA KEV catalog. An attacker with network reach to the device, especially a local attacker or one who has compromised credentials, could leverage the injection to execute commands and fully compromise the router.