{"id":"CVE-2026-16348","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-16348","summary":"An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by…","details":"An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. \n\n\n\n\nSuccessful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.","published":"2026-08-24T18:16:59.710","modified":"2026-08-24T18:16:59.710","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://www.tp-link.com/en/support/download/archer-be800/v1/#Firmware"},{"type":"WEB","url":"https://www.tp-link.com/us/support/download/archer-be800/v1/#Firmware"},{"type":"WEB","url":"https://www.tp-link.com/us/support/faq/5264/"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-24T18:16:59.710"}}