CVE-2026-9254 in Archer BE800
Summary
by MITRE • 08/24/2026
An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges.
Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified involves a critical OS command injection flaw within the parental control subsystem of specific TP-Link router models, including the Archer BE800 V1, BE3600 V1, and AX75 V1. This security defect stems from inadequate input validation mechanisms in the web management interface, specifically where user-supplied data is passed to underlying system commands without proper sanitization or encoding of special characters. The root cause lies in the improper filtering of metacharacters such as semicolons, pipes, and ampersands, which allows an attacker to terminate intended command strings and append arbitrary shell commands for execution by the operating system.
The operational impact of this vulnerability is severe due to its unauthenticated nature and network accessibility. An adversary positioned on the local area network can exploit this flaw without needing valid credentials or prior authentication. By crafting malicious HTTP requests containing injected payloads, a LAN-based attacker can achieve remote code execution with root privileges. This level of access effectively results in complete compromise of the affected device, granting the attacker full control over the router's operating system and configuration settings.
The consequences extend beyond the individual hardware unit to encompass the broader network infrastructure. With root-level access, an attacker can manipulate routing tables, intercept or modify unencrypted traffic, install persistent backdoors, and pivot attacks against other devices on the local subnet. This directly impacts the confidentiality of sensitive data traversing the network, compromises the integrity of system configurations and user communications, and threatens availability by potentially disabling network services or causing device instability through resource exhaustion or destructive commands.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. It also maps to MITRE ATT&CK techniques related to Remote Services and Execution on Local Systems, specifically highlighting the risk associated with unauthenticated access vectors within enterprise or home network environments where trusted zones are often assumed secure but lack rigorous input validation at application boundaries.
Mitigation strategies should prioritize immediate patching if a firmware update is available from the vendor that addresses this specific command injection flaw in the parental control module. In cases where patches are not yet deployed, administrators can implement temporary compensating controls such as restricting access to the router's management interface via VLAN segmentation or firewall rules that limit exposure only to trusted administrative subnets. Additionally, disabling unnecessary services and features like remote management further reduces the attack surface. Long-term resilience requires integrating automated vulnerability scanning into network monitoring routines and enforcing strict input validation standards in all firmware development lifecycles to prevent similar injection flaws from being introduced in future releases.