What is the CVSS score of CVE-2026-22220?

CVE-2026-22220 has a CVSS 3.1 base score of 4.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Archer Be230 Firmware are affected by CVE-2026-22220?

Organizations using the HTTP processing path in TP-Link Archer BE230 should be aware of moderate risk from CVE-2026-22220, a input validation vulnerability rated CVSS 4.5.

How to fix or mitigate CVE-2026-22220?

Within 30 days: Identify affected systems running the HTTP processing path in TP-Link Archer BE230 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Archer Be230 Firmware CVE-2026-22220

MEDIUM

Improper Input Validation (CWE-20)

2026-02-03 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Denial Of Service Archer Be230 Firmware

4.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.5 MEDIUM

AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Feb 03, 2026 - 18:16 nvd

MEDIUM 4.5

DescriptionCVE.org

A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

AnalysisAI

TP-Link Archer BE230 firmware v1.2 before build 20251218 rel.70420 lacks proper input validation in HTTP request processing, allowing a network-adjacent attacker with high privileges to crash the web service. An attacker exploiting this vulnerability can render the device's web interface temporarily unavailable until manual recovery or reboot occurs. No patch is currently available.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects the a denial of component of Archer Be230 Firmware. A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.