An OS command injection flaw in the Archer C20 v6 firmware web management interface allows an authenticated administrator to inject and run arbitrary shell commands on the device, bypassing insufficient input validation during WAN configuration changes. The flaw enables full device compromise, granting complete control over confidentiality, integrity, and availability, and potentially exposing or disrupting network traffic.

This issue affects devices from TP‑Link Systems Inc., specifically the Archer C20 router running firmware version 6. The vulnerability is present in the firmware shown in the official download links and relies on the web interface configuration endpoints.

The CVSS score of 8.5 marks this as high severity. EPSS information is unavailable, and the vulnerability has not yet been listed in the CISA KEV catalog. Attackers would need administrator credentials or compromised network access to reach the web interface; the flaw is exploitable only once authenticated. Once accessed, the command injection can be triggered by suitable WAN‑related configuration requests, enabling arbitrary system commands with elevated privileges.