Authenticated backup restore OS command injection in TP-LINK Archer routers

Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.

The confirmed affected products and firmware boundaries are:

• Archer AX3000: Firmware versions prior to Archer AX3000(JP)_V1_1.1.3 Build 20240415 are affected. TP-Link identifies this firmware as the corresponding remediation baseline.
• Archer AXE75: Firmware versions prior to Archer AXE75(JP)_V1_1.2.0 Build 20240320 are affected. TP-Link identifies this firmware as the corresponding remediation baseline.
• Archer AX5400: Firmware versions prior to Archer AX5400(JP)_V1_1.1.4 Build 20240429 are affected. TP-Link identifies this firmware as the corresponding remediation baseline.
• Archer Air R5: Firmware versions prior to Archer Air R5(JP)_V1_1.1.6 Build 20240508 are affected. TP-Link identifies this firmware as the corresponding remediation baseline.
• Archer AXE5400: Firmware versions prior to Archer AXE5400(JP)_V1_1.0.3 Build 20240319 are affected. TP-Link identifies this firmware as the corresponding remediation baseline.

The listed baselines include the JP and hardware-version qualifiers shown by the advisory. Do not apply firmware from another region or hardware revision without first confirming compatibility.

These products contain an OS command injection weakness (CWE-78) in the backup/restore function. A network-adjacent attacker must reach the device over the local network, authenticate with an administrative account, and restore a crafted backup file. The restore path then permits arbitrary OS commands to execute on the device. With the initial configuration, the device allows login only from the LAN port or Wi-Fi, so the available evidence supports adjacent-network reachability rather than unrestricted Internet access. The record does not identify the vulnerable parser, command construction, execution context, or exact management endpoint. The required administrative privilege is confirmed, but whether successful commands run with root-equivalent privilege is not established.

• Reachability: The attacker must be on an adjacent network and able to reach the router through a LAN connection or Wi-Fi under the initial configuration.
• Authentication: An administrative privilege is required.
• Interaction and complexity: No separate user interaction is required, and the attack conditions are assessed as low complexity.
• Public status: The supplied record does not identify a public exploit, campaign, victim, or specific IOC. That status does not prove that exploitation has not occurred.

Successful exploitation allows arbitrary OS command execution on the router after the attacker has administrative access and restores a crafted backup file. This could enable unauthorized configuration changes, interference with network operation, or service disruption, but those specific consequences are technical possibilities rather than confirmed incidents. The available evidence does not establish whether commands run as root, whether persistence is possible, or whether the attack can cross beyond the affected device. Because administrative access is already required, the flaw extends that account's capability to operating-system command execution rather than describing an unauthenticated takeover.

The flaw can turn administrative access to a router into operating-system command execution on the device.

Possible operational consequences include:

• Loss of confidentiality: Router configuration or data stored on the device could be accessed without authorization.
• Loss of integrity: Network configuration or device behavior could be changed.
• Loss of availability: The router could be disrupted, causing connectivity loss or requiring service recovery.

The returned advisories do not confirm a breach, victim, or specific incident.

1. Update the firmware: Install official firmware matching the exact model, hardware revision, and region. The remediation baselines identified by TP-Link are:

• Archer AX3000: Archer AX3000(JP)_V1_1.1.3 Build 20240415
• Archer AXE75: Archer AXE75(JP)_V1_1.2.0 Build 20240320
• Archer AX5400: Archer AX5400(JP)_V1_1.1.4 Build 20240429
• Archer Air R5: Archer Air R5(JP)_V1_1.1.6 Build 20240508
• Archer AXE5400: Archer AXE5400(JP)_V1_1.0.3 Build 20240319

1. Verify the variant before upgrading: TP-Link warns that firmware differs between regions and hardware revisions. Confirm the device label and purchase region before selecting the update package.
2. Verify after updating: Read the firmware version again in the management interface and confirm that the device no longer falls within the affected boundaries listed above.
3. The returned advisory does not document a separate workaround beyond firmware updating. Restricting LAN or Wi-Fi access and protecting administrative accounts may reduce reachability, but should not be treated as a vendor-confirmed fix.

1. Inventory TP-LINK routers from the affected product lines, including the model, hardware revision, and regional firmware track.
2. Read the installed firmware version from the management interface and compare it with the branch-specific baselines in affected_summary and remediation.
3. Identify which LAN or Wi-Fi paths can reach the management interface and which accounts have administrative privileges. This scopes exposure but does not show that exploitation occurred.
4. Review administrative logs, where available, for unusual logins and backup restore activity. This is precautionary monitoring only; the advisory does not define a specific log event or IOC.
5. Do not treat the absence of suspicious log entries as proof of safety because the available evidence does not establish complete logging coverage or a reliable exploitation indicator.