An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection
Why It Matters
Analysis dossierWhy It Matters
An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.
High
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; HIGH severity; No confirmed exploitation signal in current enrichment
Affected Products & Remediation
0 source-backed productsVendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched command-injection (CWE-78)
Exposure
- Identify installations of the affected product and compare versions with the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · A weakness class does not establish local exposure. · Rule command-injection
Exploitation evidence
- Review command interpreters spawned by the affected service or application.Telemetry: DeviceProcessEvents · Unexpected process lineage can support command-injection hunting. · Rule command-injection
Response
- Confirm the vendor mitigation or fixed version on affected assets.Telemetry: DeviceTvmSoftwareVulnerabilities · Inventory checks can verify remediation. · Rule command-injection
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- f23511db-6c3e-4e32-a477-6aa17d310630
- Record status · verification
- UPDATED · NVD API
- CPE
- Unknown
Evidence & Provenance
— No published hunting query names this record. Browse community and library queries instead.
Correlated briefings
— No published briefing references this CVE