Which versions of Archer BE230 are affected by CVE-2026-0631?

TP-Link Archer BE230 v1.2 routers contain a command injection vulnerability (CVE-2026-0631) that allows authenticated attackers to execute arbitrary code and gain full administrative control.. A patch is available.

How to fix or mitigate CVE-2026-0631?

Within 24 hours: identify all TP-Link Archer BE230 devices in your environment and restrict administrative access to dedicated security personnel only, isolating all management interfaces from user networks. Within 7 days: apply the vendor-released firmware patch to all Archer BE230 v1.2 devices and verify successful deployment through administrative access verification. Within 30 days: audit all affected routers for unauthorized configuration changes, review management access logs from the pre-patch period, and evaluate product replacement given the vendor's systemic input-validation issues evident in this vulnerability.

Archer BE230 CVE-2026-0631

Q: What is the CVSS score of CVE-2026-0631?

CVE-2026-0631 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

OS Command Injection (CWE-78)

2026-02-02 f23511db-6c3e-4e32-a477-6aa17d310630

RCE Command Injection TP-Link Archer Be230 Firmware

8.5

CVSS 4.0 · Vendor: f23511db-6c3e-4e32-a477-6aa17d310630

Severity by source

Vendor (f23511db-6c3e-4e32-a477-6aa17d310630) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Adjacent-network-only vector and mandatory high-privilege auth gate; full device compromise but no meaningful scope change beyond the router itself.

3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630).

CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 23:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 31, 2026 - 23:22 vuln.today

cvss_changed

CVSS changed

Jul 31, 2026 - 23:22 NVD

8.0 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

Patch released

Feb 06, 2026 - 18:36 nvd

Patch available

CVE Published

Feb 02, 2026 - 18:16 nvd

HIGH 8.0

DescriptionCVE.org

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent

authenticated

attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.

This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

AnalysisAI

OS command injection in TP-Link Archer BE230 v1.2 firmware (VPN modules) allows an adjacent authenticated attacker to execute arbitrary code and seize full administrative control of the router, compromising configuration integrity, network security, and service availability. This is one of multiple distinct injection flaws identified across separate code paths in the same firmware, each tracked under unique CVE IDs, indicating a systemic input-sanitization problem in this product line. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, a vendor-released patch is available.

Technical ContextAI

The affected component is the VPN module subsystem within TP-Link Archer BE230 v1.2 firmware (CPE: cpe:2.3:o:tp-link:archer_be230_firmware:*:*:*:*:*:*:*:*), a Wi-Fi 7 (BE9300) consumer/SMB router. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) identifies the root cause: user-controlled input in the VPN module is passed to a system call or shell interpreter without adequate sanitization or escaping, allowing injection of arbitrary OS-level commands. The adjacent-network attack vector (AV:A in CVSS 4.0) confirms the vulnerable interface is exposed on the LAN/Wi-Fi segment rather than the WAN, and high-privilege (PR:H) access is required, meaning the attacker must hold admin-level credentials. The existence of multiple sibling CVEs for distinct injection code paths in the same firmware version indicates the sanitization defect is not isolated to a single function.

RemediationAI

Upgrade the Archer BE230 v1.2 firmware to version 1.2.4 Build 20251218 rel.70420 or later using the firmware available at https://www.tp-link.com/us/support/download/archer-be230/v1.20/#Firmware, with patch details documented at https://www.tp-link.com/us/support/faq/4935/. Prior to patching, restrict administrative interface access to trusted administrators only and disable remote management features if enabled, reducing the pool of principals who can authenticate as high-privilege users. Disabling the VPN feature entirely would eliminate the vulnerable code path but also remove VPN functionality - weigh this trade-off against operational requirements. Segmenting the router's management interface to a dedicated, access-controlled VLAN further limits adjacent-network attacker reach and is a durable control independent of the patch.