Authenticated Remote Code Execution in TP-Link Archer BE800

Researchers have disclosed a critical remote code execution (RCE) vulnerability, tracked as CVE-2026-16348, affecting the TP-Link Archer BE800 V1 router. The flaw resides in the VPN management functionality handled by the vpn.lua script. When a user updates the VPN key configuration, the input is passed directly to the vpn_core.sh shell script without proper sanitization.

The application utilizes a flawed validation mechanism that mistakenly permits critical POSIX shell command-substitution characters, including backticks (`), $, (, ), {, and }. By supplying a crafted payload containing these characters in the server key field, an authenticated administrator can execute arbitrary commands with root privileges on the underlying router operating system. Given that this requires administrative access, the primary threat is from compromised management credentials or malicious insiders targeting the device's management interface.

Attack Chain

1. Attacker gains access to administrative credentials for the TP-Link Archer BE800 management interface.
2. Attacker authenticates to the web-based management portal.
3. Attacker navigates to the VPN configuration settings within the administration panel.
4. Attacker inputs a malicious payload containing POSIX command substitution characters (e.g., $(reboot) or $(curl ...)) into the "key" configuration field.
5. The vpn.lua script processes the input and passes the unsanitized string as an argument to vpn_core.sh.
6. The shell interpreter executes the injected command sequence with root privileges on the router.
7. Attacker achieves remote code execution to establish persistence or exfiltrate configuration data.

Impact

Successful exploitation results in full root-level compromise of the TP-Link Archer BE800 router. An attacker could potentially intercept network traffic, modify DNS settings to redirect traffic, pivot into the internal network from the router, or brick the device. As the Archer BE800 is a high-performance consumer/SOHO router, this impact is significant for home-office and small business environments where these devices may be exposed to the internet.

Recommendation

• Ensure that administrative management interfaces for network appliances are not exposed to the public internet.
• Implement strict IP-based access control lists (ACLs) to limit management portal access to trusted internal IP ranges.
• Audit logs for administrative sessions to identify unauthorized changes to VPN or core network configurations.
• Apply firmware updates provided by TP-Link as soon as they become available to remediate the input sanitization flaw in vpn.lua.