# CVE-2026-16348: TP-Link Archer BE800 command injection in VPN

Source: https://junglewise.ai/threats/cve-2026-16348-tp-link-archer-be800-command-injection-in-vpn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16348 · Severity: info · Published 2026-08-24

The TP-Link Archer BE800 V1 Wi-Fi 7 router contains a command injection vulnerability in its VPN functionality that allows administrators with valid login credentials to execute arbitrary system commands with root privileges. An attacker exploiting this can install backdoors, steal credentials, scan the local network, and launch attacks against connected devices, potentially compromising the security of all networks and devices relying on the router.

Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-16348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16348 being exploited in the wild.

**How severe is CVE-2026-16348?** Informational severity, published 24 August 2026.

**Which products and versions are affected?** TP-Link Archer BE800 V1.

**Is there a fix for CVE-2026-16348?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-16348 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-16348?** Check whether you run TP-Link Archer BE800 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authenticated command injection flaw in the VPN connection handling code of the Archer BE800 V1. The vulnerable component fails to properly sanitize shell metacharacters in VPN-related parameters before passing them to system commands. An attacker with administrative access can inject shell metacharacters (such as backticks, pipes, or semicolons) through VPN configuration fields to break out of intended command boundaries and execute arbitrary commands with root privileges. Exploitation requires valid admin credentials and is not known to have been exploited in the wild as of publication.

## Affected products

- TP-Link Archer BE800 V1

## Timeline

- 2026-08-24: disclosed
- other: CVE-2026-16348 assigned

## References

- [https://www.tp-link.com/en/support/download/archer-be800/v1/](https://www.tp-link.com/en/support/download/archer-be800/v1/)
- [https://www.tp-link.com/us/support/download/archer-be800/v1/](https://www.tp-link.com/us/support/download/archer-be800/v1/)

## Related threats

- [TP-Link Archer OS command injection in parental control](https://junglewise.ai/threats/cve-2026-9254-tp-link-archer-os-command-injection-in-parental-control)