Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-16348 — TP-Link Archer BE800 V1 — VPN Key Injection RCE | Kitploit
Tools/GitHubGitHub/slagzz/cve-2026-16348
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubslagzz/cve-2026-16348

CVE-2026-16348

TP-Link Archer BE800 V1 — VPN Key Injection RCE

View Repository
2 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

TP-Link Archer BE800 V1 — Authenticated RCE via VPN Key Injection

CVE: CVE-2026-16348
CVSS: 8.5 (High) — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Auth required: Valid admin credentials
Network position: Network (remote if management interface exposed)

Summary

The VPN server management endpoint in vpn.lua passes the user-supplied server key field into a shell command via execute(string.format("vpn_core.sh start %s %s %s %s", ...)). The key field is validated against an allow-list that permits backtick (`), $, (, ), {, and — the complete set of POSIX shell command-substitution operators. Injecting into the key field executes arbitrary commands as root.

Download Tool
}
$(command)

Demo

demo

Blog Writeup

https://uploadsecurity.com/Blog/CVE-2026-16348_research.html

Researcher

[email protected]