TP-Link Archer BE230 CVE-2026-22221

Exploitation requires ALL of the following: (1) network adjacency to the target - the attacker must be on the same local segment / Wi-Fi network, not the public internet (AV:A); (2) existing high-privilege authentication to the router's admin interface (PR:H) - this is a post-authentication flaw, not a pre-auth bypass; and (3) access to the VPN configuration modules on Archer BE230 firmware v1.2 below 1.2.4 Build 20251218 rel.70420, which contains the vulnerable code path. Limiting factors: the need for prior admin credentials and LAN/Wi-Fi presence substantially narrows the attacker population; no user interaction is required (UI:N) and complexity is low (AC:L) once those preconditions are met. Devices where untrusted parties can obtain LAN access or admin sessions are most at risk.

This is a genuine but access-gated flaw whose signals are internally consistent and point to moderate-not-critical priority. The vendor CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) requires an adjacent attacker (same L2/Wi-Fi segment, not internet-routable) who is ALREADY authenticated at high privilege (PR:H). That combination sharply limits real-world exploitability: an attacker who already holds admin credentials on the router derives limited additional value from turning that into OS command execution - the main gain is a persistent root shell / firmware-level foothold rather than a privilege jump from unauthenticated to admin. EPSS is low at 0.12% (31st percentile), there is no CISA KEV listing, and no public exploit code was identified, so all three exploitation-likelihood signals agree on low near-term risk. The 8.5 score is driven by high technical impact (full C/I/A on the device), not by ease of access. Note the vendor description phrases the attacker as 'adjacent authenticated,' which matches AV:A/PR:H - no conflict between description and vector here. Bottom line: high-impact-but-hard-to-reach; patch on a normal cadence rather than emergency footing, prioritizing devices where untrusted users share the LAN/Wi-Fi.

An attacker on the same local/Wi-Fi network who already possesses valid administrative credentials for the router navigates to the VPN configuration module and submits a crafted parameter that is passed unsanitized to a shell, executing arbitrary OS commands as root. This yields full control of firmware, configuration, and traffic on the device. No public exploit code has been identified, and exploitation requires both network adjacency and existing admin access.