An authenticated command injection flaw is present in the web management interface of the Archer BE450 v1 and BE7200 V1 routers. After login, a user can manipulate the browser’s developer console to inject payloads that bypass input sanitization. The injection delivers arbitrary shell commands with elevated privileges, enabling full compromise of the router’s operating system, such as starting unauthorized services, modifying configuration, or tampering with network traffic. The vulnerability is identified as CWE‑20 input validation failure.

TP‑Link Archer BE450 version 1 and TP‑Link Archer BE7200 version 1 are affected. No additional product versions are listed in the CNA data, so only these hardware models and firmware releases are considered at risk.

The flaw has a CVSS score of 8.5, indicating high severity. Exploitation requires authenticated administrative access to the router, which suggests the attack vector is local networks with admin credentials, but remote exploitation is feasible if an attacker can gain those credentials. The EPSS score is not available, but the lack of KEV listing reduces the likelihood of widespread exploitation at this time. Nonetheless, the ability to execute privileged commands provides a clear path to full device compromise, warranting immediate attention.