CVE-2026-78541

Awaiting Analysis Awaiting Analysis - Queue

Stored OS Command Injection in TP-Link Archer BE3600

Publication date: 2026-08-24

Last updated on: 2026-08-28

Assigner: TPLink

Description

A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-28

Generated

2026-09-14

AI Q&A

2026-08-24

EPSS Evaluated

2026-09-13

NVD

CVE-2026-78541

EUVD

EUVD-2026-65062

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	archer_be800	v1
tp-link	archer_ax75	v1
tp-link	archer_be3600	v1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is a stored OS command injection vulnerability in TP-Link Archer BE3600 V1's parent-control module. An authenticated attacker with admin access can store a malicious profile name containing shell commands. When the device generates daily cloud reports, it processes this unsafely, allowing arbitrary command execution on the device.

Detection Guidance

Detection of this vulnerability requires checking for unauthorized command execution attempts or suspicious activity in the parental control module logs. Monitor network traffic for unusual outbound connections from the device. Inspect stored profile names for shell metacharacters or unexpected commands. Verify if the device has the latest firmware applied to confirm if the vulnerability is patched.

Impact Analysis

Exploitation may allow attackers to execute commands on your device, potentially compromising its confidentiality, integrity, and availability. This could lead to unauthorized access, data theft, or device malfunction.

Compliance Impact

This vulnerability allows arbitrary command execution on the device, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or health-related data stored or transmitted through the device.

Mitigation Strategies

Apply the latest firmware update from TP-Link for Archer BE3600 V1 to patch the stored OS command injection vulnerability in the parent-control module.

Hi! I’m here to help you understand CVE-2026-78541. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70