An authenticated command injection flaw is present in the web management interface of the Archer BE450 v1 and BE7200 V1 routers. After login, a user can manipulate the browser’s developer console to inject payloads that bypass input sanitization. The injection delivers arbitrary shell commands with elevated privileges, enabling full compromise of the router’s operating system, such as starting unauthorized services, modifying configuration, or tampering with network traffic. The vulnerability is identified as CWE-20 input validation failure as well as CWE-77 command injection.

TP‑Link Archer BE450 version 1 and TP‑Link Archer BE7200 version 1 are affected. No additional product versions are listed in the CNA data, so only these hardware models and firmware releases are considered at risk.

The flaw has a CVSS score of 8.5, indicating high severity. Exploitation requires authenticated administrative access to the router, suggesting the attack vector is local networks with admin credentials, though remote exploitation is possible if an attacker obtains those credentials. The EPSS score of 2% indicates a relatively low exploitation probability, and the lack of KEV listing further reduces the likelihood of widespread exploitation. Nonetheless, the ability to execute privileged commands provides a clear path to full device compromise, warranting immediate attention.