CVE-2026-16348: TP-Link Systems Inc Archer BE800 v1

High severity, CVSS 8.5. EPSS: 2% chance of exploitation in the next 30 days.

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection.  Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.

Affected products

• TP-Link Systems Inc Archer BE800 v1: before 1.4.2 Build 260708 (fixed in 1.4.2 Build 260708)

Published 2026-08-24. Last modified 2026-08-28.