CVE-2026-78541: Archer BE3600 v1 0 to before 1.2.6 Build 20260617

Affected technology

Archer BE3600 v1 · 0 to before 1.2.6 Build 20260617
TP-Link Systems Inc.

Component: parent-control

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · High privileges required · No user interaction required

What an attacker can do

An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Source advisory’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality, integrity and availability impact as high.