This vulnerability is an operating system command injection that can be triggered after an administrator authenticates by importing a specially crafted VPN client configuration file. The flaw allows an attacker who can perform the import to execute arbitrary commands on the device, giving complete administrative control and compromising the router’s configuration, network security, and service availability.

TP‑Link Systems Inc. devices. The Archer BE230 running firmware version 1.2 (up to but not including 1.2.4 Build 20251218 rel. 70420) and the Deco BE25 with firmware 1.0 through 1.1.1 Build 20250822 are affected.

The issue carries a high CVSS score of 8.6, indicating substantial impact if successfully exploited. The EPSS score is listed as less than 1 %, implying that current exploitation activity is low or not observed. The vulnerability is not present in CISA’s KEV catalog, so known exploit activity is not confirmed. Attackers require authenticated administrator access to trigger the import path. If an attacker can obtain admin credentials through credential compromise, social engineering or lateral movement, they could supply the malicious configuration file and gain full control of the device. The exploitation path is thus limited to environments where administrative access can be achieved remotely or the attacker can influence an existing admin user.