Multiple TP-Link Archer Vulnerabilities Enable Command Injection Attacks

TP-Link disclosed three high-severity command-injection vulnerabilities impacting Archer BE800 V1, BE3600 V1, and AX75 V1 routers that allow attackers to execute arbitrary commands as root (one is unauthenticated; others require admin access). The advisory provides CVE identifiers, CVSS v4.0 scores (~8.5–8.7), affected firmware versions and fixed releases, and recommends immediate firmware updates, credential changes, and reduced admin exposure to mitigate risk.