The Archer AX72 router’s web‑management interface contains a diagnostic feature that does not correctly validate malformed input. When an attacker submits invalid data, the interface returns a list of acceptable diagnostic command names and syntax. This disclosure allows an attacker to confirm that the diagnostic utility is present and learn how to use it, but it does not reveal passwords, configuration files, or other sensitive data.

The only affected product is TP‑Link Systems Inc.’s Archer AX72 (SG) firmware version 1.0. No other vendors or product variants are listed in the advisory.

The CVSS score of 4.6 reflects a moderate confidentiality impact and no denial‑of‑service or privilege escalation. Exploitation requires an authenticated user with administrative privileges, which reduces the probability of a widespread attack. EPSS data is not available and the vulnerability is not listed in the KEV catalog, indicating that the current exploitation risk is low, though discovery of the diagnostic commands could assist future attacks if paired with other weaknesses.