TP-Link Archer MR600 Command Injection Vulnerability in Admin Interface

A command injection vulnerability has been identified in the admin interface of TP-Link Archer MR600 v5 routers, running firmware prior to version 1.1.0 0.9.1 v0001.0 Build 250930 Rel.63611n. This vulnerability allows authenticated attackers to execute arbitrary system commands by injecting crafted input through the browser's developer console. The exploitation of this vulnerability could disrupt services or lead to a complete compromise of the device.

Impact

Exploitation of this vulnerability allows authenticated attackers to execute arbitrary operating system commands on the affected device, potentially leading to a full compromise of the router.

Remediation

Users are advised to update the firmware to the latest version. The latest firmware for the Archer MR600 v5 can be downloaded from the TP-Link official website, ensuring to select the correct regional site to avoid warranty issues.