TP-Link just disclosed command-injection flaws in three popular Archer routers - one of them needs no password at all to exploit. It is the third new advisory in a week. Here is how to check your router in five minutes, without panic.
A router is a small computer with an antenna. It runs software, and like in every other computer, that software has bugs. Some of those bugs let strangers in. The difference between your router and your phone is that nobody ever updates the router, so the bugs stay there for years.
The good news: the fix is usually one update, and the check takes less time than brewing coffee. This is the pattern, the checklist, and the honest version of how worried you should be.
The Wave, in Plain English
Over the last few weeks, security researchers and vendors have disclosed a cluster of flaws in consumer routers. The one that got attention was TP-Link’s: command injection in three Archer models. Command injection sounds technical. In practice it means a stranger can send a specially crafted request to your router and get it to run their own instructions - without a password.
The list of recently disclosed families includes:
- Unauthenticated command injection in parental controls (CVE-2026-9254) - affects the Archer BE800, BE3600, and AX75. “Unauthenticated” is the scary word: no login needed.
- A hardcoded backdoor account (CVE-2026-12001) - a hidden login that ships with the router.
- Command injection in the firmware update flow (CVE-2026-17250) - pinned to the TL-MR6400 v7, rated 8.5 out of 10 on the CVSS severity scale.
- A pre-auth remote code execution on Omada gateways (CVE-2026-19586) - through the OpenVPN feature.
That is roughly ten advisory families in the current wave, and the count has grown every week. Two of the vendor advisories were updated in the last 48 hours. The fixed firmware builds are dated August 2026 - which means the fix exists, and the window to apply it is now.
Here is the thing to notice about the pattern: none of this is exotic. These are ordinary flaws in ordinary consumer gear, disclosed in the normal way. The reason they matter is that most people will never hear about them, and most routers will never be updated.
Why Your Router Never Gets Updated
Your phone updates itself. Your computer updates itself. Your router does not. It sits on the shelf, does its job, and quietly keeps running the same software it shipped with in 2019.
The router manufacturers would prefer you to check their support pages monthly. Nobody does. The result is that a device with a ten-year life gets maybe one update in its lifetime, usually because something stopped working.
The security industry has a name for this. It is not a conspiracy; it is an incentive problem. The router company sold you the box once. Updates cost them money and make them nothing. So updates arrive slowly, if at all, and only when the publicity gets bad enough.
That is the pattern this whole wave proves: when a vendor gets embarrassed enough, a fixed firmware appears. The fixed builds exist for the current flaws. Your job is just to find out whether your router is affected, and then either update it or replace it.
The Five-Minute Check
Step 1: Find your exact model (30 seconds)
Turn the router over. The sticker on the bottom has the model number - something like Archer AX75 or TL-MR6400. Write it down exactly, including any version number that appears (v1, v2, v7). The version matters. A fix for v7 does not always apply to v5.
If the sticker is unreadable or the router is mounted somewhere awkward, log into the router’s admin page instead (the address is usually printed on the same sticker - commonly 192.168.1.1 or 192.168.0.1) and look at the status or system info page. It will list the model and firmware version.
Step 2: Check whether your model is on the list (2 minutes)
The authoritative source is the National Vulnerability Database (NVD) at nvd.nist.gov. Search for your exact model number, for example “Archer AX75” or “TL-MR6400.” OpenCVE (opencve.io) mirrors the same data with a friendlier search.
If your model shows no entries, you are clear today. If it shows entries, read the CVSS score and the description. A score above 7 with the word “unauthenticated” or “remote” means the flaw is exploitable by a stranger over the internet - the serious kind.
You can also check the vendor’s own security advisories. TP-Link publishes them on its support site, and the recent updates (FAQ 5264 and FAQ 5259, both updated this week) cover the current Archer flaws.
Step 3: Apply the fix (2 minutes)
Two paths:
Update. Log into the router admin page, find the firmware section (usually under System, Administration, or Advanced), and check for an update. If one exists, apply it and let the router reboot. This is the outcome you want: a patched router, done.
Replace. If your router is more than five years old, or the vendor’s site shows no fix for your model, consider whether it is worth keeping. A current-model router that is being patched is fine. An old router with a known flaw and no fix in sight is a liability. The honest version of this advice: if the check reveals your model is on a list with no fix, a new router is not a luxury purchase, it is the fix. Our router buying guide walks through what to look for without you having to read the marketing.
The “Is It Really Worth It?” Question
Every router security article has to answer this, so here is the direct answer.
The flaws in the current wave are real, and a couple of them are exploitable by a stranger with no password. That is the bad news. The good news is the exploit path is not a person sitting in a van outside your house typing at your router. It is automated scanning: bots sweep the internet for vulnerable devices, and they find them by the hundreds of thousands because so many routers are never updated.
Your router being patched moves you out of that sweep. It is the same logic as locking your front door: the lock does not make you invulnerable, it makes the opportunist move on to the next house.
The practical baseline: do the five-minute check once, then again every quarter. Put it on the calendar with the smoke alarm batteries. A router is the one device in your home that every other device connects through - the network security basics guide explains why that makes it the highest-value target in the house.
What Not to Do
Three things are not part of the fix:
- Do not buy a new router out of panic before checking the model. Half the models in the current wave have fixes available. The update is free.
- Do not ignore it because your internet “works fine.” Every router works fine until the day it is used against you. The flaws have nothing to do with performance.
- Do not assume your internet provider handles it. ISP-provided routers are updated by the ISP, and some do it quietly. The router you bought yourself is your job. If you are not sure which kind you have, check the brand on the sticker - if it is your ISP’s name, they own the updates.
A Worked Example
Here is what the check looks like in practice, so it is not abstract.
Say the sticker on your router says Archer AX75. Step one is done. Step two: open nvd.nist.gov, search “Archer AX75.” You get a short list. One entry is the parental-controls command injection from the current wave, rated high, and the description says the exploit needs no authentication. That means your model is affected, and the fix is a firmware build from August 2026.
Step three: log into the admin page. The firmware section shows your current version - say June 2025 - and an update button. You click it, wait three minutes for the reboot, and log back in to confirm the version now reads August 2026. Total time: under five minutes, done.
Now the same search for a model with no entries. You get an empty list, or entries only about something unrelated like a port-routing quirk. You are clear today. Write the model down, set a reminder for the quarter, and move on.
That is the whole process. The scary part is the reading; the doing is a sticker, a search box, and a button.
What If You Cannot Find a Fix
Sometimes the search comes up empty in the wrong way: your model is on the vendor’s advisory list, but the vendor has not published a fixed firmware yet. This happens with older models that vendors have quietly stopped supporting.
The honest answer is that an unsupported router with a known remote flaw should not stay on your network. A device that is no longer receiving security updates is not a device you can make safe with settings. It is a device waiting to be exploited.
The replacement does not need to be expensive. The buying guide covers the honest minimum: a current model from a brand that publishes firmware updates, at any price point. A router that gets patched is worth more than a fancier router that never will.
The Bottom Line
A wave of router flaws is out, the fixes are landing now, and the check takes five minutes: find the model, search the model, apply the update. Most people will never do this. That is exactly why it is worth doing - the routers that get patched are the ones that do not end up in the botnets.
Do it once today, then every quarter. That habit is the entire security strategy for home networking, and it costs nothing.