Caprinuxx

**Name of the Vulnerable Software and Affected Versions** TP-Link Deco BE25 versions through 1.1.1 Build 20250822 **Description** A flaw exists in the administration web interface of the device that allows crafted input to be executed as part of an OS command. An authenticated attacker in a nearby network can potentially execute arbitrary commands through a specially crafted configuration file. This could compromise the confidentiality, integrity, and availability of the device. **Recommendations** Update TP-Link Deco BE25 to a version later than 1.1.1 Build 20250822.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420 **Description** A command injection may occur after administrative authentication within the cloud communication interface. Successful exploitation could grant an attacker full administrative control of the device, potentially compromising configuration integrity, network security, and service availability. This issue is one of several distinct command injection issues identified in separate code paths. **Recommendations** Update to version 1.2.4 Build 20251218 rel.70420 or later.

**Name of the Vulnerable Software and Affected Versions** Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420 **Description** A command injection may occur following administrative authentication within the VPN Connection Service. Exploitation could grant an attacker complete administrative control over the device, potentially compromising configuration integrity, network security, and service availability. This issue is one of several distinct command injection flaws identified in separate code paths. **Recommendations** Update to version 1.2.4 Build 20251218 rel.70420 or later.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420 **Description** A command injection issue exists that may be triggered after administrative authentication through importing a specially crafted VPN client configuration file. Successful exploitation could grant an attacker complete administrative control over the device, potentially compromising configuration integrity, network security, and service availability. This is one of several distinct command injection issues identified in separate code paths. **Recommendations** Update to version 1.2.4 Build 20251218 rel.70420 or later.