CVE-2026-16348

TP-Link Archer BE800 V1 — 認証済みRCE（VPNキーインジェクション経由） CVE: CVE-2026-16348 CVSS: 8.5（高） — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L 必要な認証: 有効な管理者資格情報 ネットワーク位置: ネットワーク（管理インターフェースが公開されている場合はリモート） 概要 vpn.lua のVPNサーバー管理エンドポイントは、ユーザーが指定したサーバーの key フィールドを、executestring.format"vpncore....

CVE-2026-16348

TP-Link Archer BE800 V1 is affected by an authenticated command injection in its VPN connection handling. An attacker with administrative access can inject shell metacharacters via the VPN connection to execute arbitrary system commands with root privileges . Successful exploitation may enable pe...

EUVD-2026-65007

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

CVE-2026-16348 Command Injection Vulnerability in VPN connection of Archer BE800

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...

PT-2026-80979

An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors,...