A command injection flaw exists in the WireGuard client configuration of TP‑Link Archer MR600 v5, caused by inadequate neutralization of user‑controlled input in the web management interface. An attacker who has authenticated administrative privileges can exploit this to run arbitrary commands when configuration changes are applied, potentially leading to full compromise of device confidentiality, integrity, and availability.

TP‑Link Systems Inc. Archer MR600 v5 firmware version 5 is affected.

The vulnerability has a CVSS score of 8.5, indicating high severity. EPSS data is not available and the issue is not listed in CISA KEV. An authenticated administrator already possesses the necessary access, so the attack vector is likely the web interface used to apply WireGuard settings. Successful exploitation would grant an attacker the ability to execute arbitrary commands on the device and control its network traffic.