{"id":"CVE-2026-16348","title":"An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. \n…","summary":"An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. \n…","severity":"none","cwe":["CWE-78"],"published":"2026-08-24","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16348","references":[{"url":"https://www.tp-link.com/en/support/download/archer-be800/v1/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/archer-be800/v1/#Firmware","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5264/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd","exploit-available"],"epss":0.01956,"epssPercentile":0.79732,"exploits":{"github":1,"githubRepos":["https://github.com/Slagzz/CVE-2026-16348"],"checkedAt":"2026-10-12T15:55:43.148Z"},"exploitAvailable":true,"ingestedAt":"2026-10-12T15:55:08.128Z","slug":"CVE-2026-16348","body":"## Overview\n\nAn authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. \n\n\n\n\nSuccessful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[]}