TP-Link Archer Flaw: Root Access From Inside Your Own Wi-Fi

Anyone who can join the Wi-Fi on a TP-Link Archer BE800, BE3600 or AX75 can take full control of the router without a password. That's the plain-English version of CVE-2026-9254, an unauthenticated OS command-injection flaw in the routers' parental control feature, disclosed by TP-Link on 24 August 2026 and rated CVSS 8.7 (High). The twist is where the attacker has to be: not out on the internet, but already inside your network. For a lot of small offices, that's a far lower bar than it sounds.

What happened, in plain English

TP-Link's advisory covers three command-injection bugs across its Archer consumer and prosumer Wi-Fi routers. All three are the same underlying mistake, listed as CWE-78: the router takes text you give it, drops it into a shell command, and doesn't strip out the characters that let that text turn into commands of its own.

• CVE-2026-9254 is the one that matters most. The parental-control function on the Archer BE800 V1, BE3600 V1 and AX75 V1 fails to filter special characters in certain parameters. An attacker on the local network can feed it crafted input and have the router run commands as root. No login is required. The CVSS vector confirms it: attack vector adjacent (you need to be on the LAN or Wi-Fi), privileges required none, user interaction none, and high impact on confidentiality, integrity and availability. Score: 8.7.
• CVE-2026-16348 affects the BE800 V1 only. It's a command injection via the router's VPN connection settings, but it needs administrator access first. Score: 8.5.
• CVE-2026-78541 affects the BE3600 V1 only. It's a stored injection: an administrator saves a parental-control profile name containing shell characters, and the router later runs it unsafely while generating its daily cloud report. Again, admin access required. Score: 8.5.

So the honest nuance is this: two of the three flaws need someone who already has the admin password, which makes them a much smaller worry for most businesses. The first one doesn't need anything except a seat on your network.

Fixed firmware is available for all three models:

| Model | Fixed firmware | CVEs addressed | |-------|---------------|----------------| | Archer BE800 V1 | 1.4.2 Build 260708 | CVE-2026-9254, CVE-2026-16348 | | Archer BE3600 V1 | 1.2.6 Build 20260617 | CVE-2026-9254, CVE-2026-78541 | | Archer AX75 V1 | 1.1.6 Build 260716 | CVE-2026-9254 |

As of writing, none of these CVEs appears on CISA's Known Exploited Vulnerabilities catalogue, and we've seen no credible report of in-the-wild exploitation. This is a "patch it this week" story, not a "drop everything" one. But do patch it.

Why this one matters: "LAN-only" is not the same as "safe"

It's tempting to read adjacent network in a CVSS vector and relax. The attacker has to be on my Wi-Fi? Fine, nobody's on my Wi-Fi.

Think about who actually is. In a typical small business the same router serves the point-of-sale terminal, the accountant's laptop, a smart TV in reception, a couple of security cameras, a printer nobody has updated since it was unboxed, and every phone belonging to every staff member, contractor and visitor who has ever been told the password. In a shared office or a shop below a flat, "the LAN" might include the neighbours.

Any one of those devices being compromised, or any one of those people being careless or curious, is enough. From there, this flaw hands over the router itself: the box that sees every packet leaving your business, hands out DNS, and decides where your traffic goes. A router with an attacker as root can silently redirect your banking site, intercept email, or park quietly for months as a foothold. That's the real lesson here: the router's security boundary is your Wi-Fi password, and for most small businesses that password is not a boundary at all.

There's a second, smaller lesson in where the bug lives. Parental controls are a home feature: friendly, rarely audited, and switched on by someone who wanted to keep the kids off YouTube after 9pm. Consumer-grade convenience features are exactly where this class of bug tends to hide. That's not a knock on families using them; it's a reminder that a router designed for a household is carrying a household's threat model, even when it's running a business.

The honest bit

No vendor is immune, including the ones we like. Command injection in a management interface is the same category of mistake we've written about in Cisco's RV routers, in Zyxel's ISP gear, and earlier this year in TP-Link's own Omada line. Nobody has a clean sheet.

Credit where it's due: TP-Link assigned the CVEs itself, published clear per-model fix versions, and the build numbers in those firmware releases suggest the fixes were compiled in June and July, before the August advisory. That's responsible handling.

One genuine difference worth knowing about, framed as advice rather than a pitch: business-grade, cloud-managed networking gear typically pushes security fixes to devices automatically and tells you, in a dashboard, which devices are behind. A home router only updates if someone remembers to open the app. For a business, the question isn't which brand is better; it's whether anyone is on the hook for keeping the router current, and whether the network is designed so that a guest's phone can't reach the router's management side at all.

What we'd suggest you actually do

1. Check whether you have one. Look for an Archer BE800, BE3600 or AX75 and confirm the hardware version on the label (these flaws are in V1 units). If your router was supplied by your ISP under a different name, our post on ISP-supplied TP-Link gear explains why it still needs watching.
2. Update the firmware now. Open the router's admin page or the TP-Link Tether app and update to at least the versions in the table above, or download them from TP-Link's support site. Then turn on automatic updates if the model offers it.
3. Separate guests and gadgets from the business. Put visitors, personal phones, cameras and smart TVs on a guest or isolated network that cannot see the main LAN or the router's admin interface. This single change turns a "LAN-only" flaw back into something an outsider genuinely can't reach.
4. Rotate the Wi-Fi password, and treat it as a credential. If it's been the same since the router was installed, everyone who has ever worked there still has it.
5. Do the basics on the router itself. Unique admin password, remote management off unless you truly need it, and a quick look through the admin logs for anything you don't recognise.
6. Decide whether a home router is still the right box. If this device is the only thing between your business and the internet, put a replacement with a support lifecycle and managed updates on the plan. Not today, but on the plan.

The friendly takeaway

This isn't "TP-Link bad." It's three bugs, all fixed, one of which is worth a prompt firmware update because it doesn't need a password, only a seat on your Wi-Fi. The lasting takeaway is bigger than any one router: for a small business, the local network is not a trusted place, and the router should be designed and updated as though it isn't.

As always, this post is part of us keeping watch so you don't have to. If you'd like a second pair of eyes over what's on your network, who can reach what, and whether anything is quietly overdue for an update, get in touch. No obligation, no hard sell; a quick look is often all it takes.

References

• TP-Link Security Advisory: Multiple Command Injection Vulnerabilities in Archer Products (CVE-2026-9254, CVE-2026-16348, CVE-2026-78541)
• NVD — CVE-2026-9254 (unauthenticated OS command injection, parental control, CVSS 8.7)
• NVD — CVE-2026-16348 (authenticated command injection, VPN, BE800 V1, CVSS 8.5)
• NVD — CVE-2026-78541 (stored command injection, parental control, BE3600 V1, CVSS 8.5)
• CISA — Known Exploited Vulnerabilities Catalog (no listing for these CVEs at time of writing)
• Cyber Security News — Multiple TP-Link Archer Vulnerabilities Enable Command Injection Attacks