CVE-2026-9254: Archer BE800 V1 0 to before 1.4.2 Build 260708; +2 more affected products

Affected technology

Archer BE800 V1 · 0 to before 1.4.2 Build 260708
TP-Link Systems Inc.

Archer BE3600 V1 · 0 to before 1.2.6 Build 20260617
TP-Link Systems Inc.

Archer AX75 V1 · 0 to before 1.1.6 Build 260716
TP-Link Systems Inc.

Component: parent control

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Source advisory’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.