This vulnerability involves improper input validation (CWE-20) in the web management interface of TP-Link Archer BE450 v1 and BE7200 v1 routers. After authenticating as an administrator, an attacker can inject commands via crafted input passed to backend system commands without adequate sanitization. This enables arbitrary command execution with elevated privileges on the device, potentially allowing full control over the router's operating environment. The CVSS 4.0 score is 8.5, reflecting high impact and low attack complexity given administrative access. No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated administrator to execute arbitrary system commands with elevated privileges on the affected routers. This can result in unauthorized service execution, modification of system configurations, and full compromise of the device's operating environment. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to the router's web interface to trusted personnel only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks.