## https://sploitus.com/exploit?id=C46C3E4E-503F-5679-B9A2-79AC4114C495
# CVE-2026-16348
# TP-Link Archer BE800 V1 — Authenticated RCE via VPN Key Injection
**CVE:** CVE-2026-16348
**CVSS:** 8.5 (High) — `CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L`
**Auth required:** Valid admin credentials
**Network position:** Network (remote if management interface exposed)
---
## Summary
The VPN server management endpoint in `vpn.lua` passes the user-supplied server **key** field into a shell command via `execute(string.format("vpn_core.sh start %s %s %s %s", ...))`. The key field is validated against an allow-list that permits backtick (`` ` ``), `$`, `(`, `)`, `{`, and `}` — the complete set of POSIX shell command-substitution operators. Injecting `$(command)` into the key field executes arbitrary commands as root.
---
## Demo
## Blog Writeup
https://uploadsecurity.com/Blog/CVE-2026-16348_research.html
---
## Researcher
sean.lagan@uploadsecurity.com