CVE-2026-78541: TP-Link Archer BE3600 RCE Vulnerability

CVE-2026-78541 Overview

CVE-2026-78541 is a stored operating system (OS) command injection vulnerability in the parent-control module of the TP-Link Archer BE3600 V1 router. An authenticated attacker with administrative access on an adjacent network can store a crafted profile name containing shell metacharacters. The router processes this profile name unsafely during its daily cloud report generation, resulting in arbitrary command execution on the device. Successful exploitation impacts device confidentiality, integrity, and availability. The vulnerability is tracked under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
An adjacent attacker with admin credentials can achieve persistent arbitrary command execution on the router by injecting shell metacharacters into a stored parent-control profile name.

Affected Products

TP-Link Archer BE3600 V1 (firmware versions prior to V1.26)
Parent-control module of the affected firmware
Router configurations with cloud reporting enabled

Discovery Timeline

2026-08-24 - CVE-2026-78541 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78541

Vulnerability Analysis

The flaw is a stored OS command injection in the parent-control feature of the Archer BE3600 V1. Administrators can define parental-control profiles by providing a profile name. The router stores these names in its configuration and later reads them during scheduled daily cloud report generation.

During report generation, the stored profile name is passed to a shell context without adequate sanitization or quoting. Shell metacharacters such as ;, |, `, and $() are interpreted by the underlying shell rather than being treated as literal string data. Because report generation runs with elevated router privileges, injected commands execute in that same context.

The attack requires prior authenticated administrative access and adjacent network positioning (typically Wi-Fi or LAN). The exploitation window is deferred: the payload triggers when the daily cloud reporting job runs, providing persistence across administrator sessions.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The parent-control module writes user-supplied profile names into configuration storage without input validation. The cloud reporting subroutine concatenates the stored name into a shell command line without escaping or parameterized execution, allowing attacker-controlled metacharacters to break out of the intended argument.

Attack Vector

Exploitation requires the attacker to already possess administrative credentials and to be on an adjacent network. The attacker logs into the router web interface and creates or edits a parental-control profile whose name embeds shell metacharacters followed by an arbitrary command. The router stores the crafted name. When the daily cloud report task subsequently runs, the shell parses the injected command and executes it under the reporting process context.

Because the payload is stored, no attacker presence is required at execution time. This yields effective persistence and complicates identification through session-based monitoring.

Detection Methods for CVE-2026-78541

Indicators of Compromise

Parental-control profile names containing shell metacharacters such as ;, |, &, backticks, or $(...) sequences.
Unexpected outbound network connections originating from the router around the daily cloud report generation window.
Unauthorized administrative logins to the Archer BE3600 V1 web interface preceding profile creation or modification.
Router configuration changes to parental-control settings not attributable to a known administrator.

Detection Strategies

Audit the router configuration backup for parent-control profile names and flag any entries containing non-alphanumeric shell metacharacters.
Monitor DNS and network flow telemetry for anomalous connections sourced from the router IP, particularly outside firmware update and cloud reporting endpoints.
Correlate administrative login events with subsequent parental-control configuration changes to identify unauthorized modifications.

Monitoring Recommendations

Enable and forward router system logs to a centralized log store for retention and query.
Alert on failed and successful administrative authentication events against the router management interface.
Track firmware version reporting across the fleet to ensure devices are running V1.26 or later.

How to Mitigate CVE-2026-78541

Immediate Actions Required

Upgrade affected Archer BE3600 V1 devices to firmware V1.26 or later from the TP-Link Archer BE3600 Firmware V1.26 download page.
Rotate the router administrator password and review all administrative accounts for unauthorized additions.
Review existing parental-control profiles and delete any entries whose names contain shell metacharacters.
Restrict management-interface access to trusted wired hosts and disable remote administration if not required.

Patch Information

TP-Link has published updated firmware for the Archer BE3600 V1. Firmware V1.26 addresses this issue and is available from the TP-Link Archer BE3600 Firmware download portal. Refer to the TP-Link Archer BE3600 FAQ for upgrade guidance.

Workarounds

Disable the cloud reporting feature on the router until firmware V1.26 can be applied, which prevents the vulnerable code path from being invoked.
Disable the parental-control feature if it is not in active use.
Segment the router management VLAN so that only authorized administrator hosts can reach the web management interface.

bash

# Configuration example: verify firmware version and disable remote management via CLI (illustrative)
# 1) Check current firmware from the web UI: System Tools > Firmware Upgrade
# 2) After upgrade to V1.26+, confirm parental-control profile names contain only alphanumeric characters
# 3) Disable remote (WAN) management: System Tools > Administration > Remote Management = Disabled