This vulnerability (CVE-2026-16348) affects TP-Link Archer BE800 v1 routers. It is an OS command injection flaw (CWE-78) that allows an authenticated attacker with administrative privileges to inject shell metacharacters through the VPN connection interface. This injection enables execution of arbitrary system commands with root-level privileges on the device. The vulnerability could be leveraged to establish persistent backdoors, steal credentials, perform reconnaissance on the local network, and launch attacks on devices connected to the compromised router.

Successful exploitation grants root-level command execution on the affected device, enabling attackers to maintain persistent access, steal sensitive credentials, gather intelligence on the local network, and facilitate further attacks on connected devices. This compromises the confidentiality, integrity, and availability of the router and the network it serves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Until a patch is available, restrict administrative access to trusted users and networks, and monitor for suspicious activity on the VPN interface.