Which versions of TP-Link Archer BE230 are affected by CVE-2026-22226?

TP-Link Archer BE230 routers running firmware prior to version 1.2.4 Build 20251218 rel.70420 contain a critical command injection vulnerability (CVSS 8.5) that allows authenticated administrators to…. A patch is available.

How to fix or mitigate CVE-2026-22226?

Within 24 hours: Conduct inventory of all TP-Link Archer BE230 routers and identify systems running firmware prior to version 1.2.4 Build 20251218 rel.70420; assess exposure risk for each device. Within 7 days: Download firmware version 1.2.4 Build 20251218 rel.70420 or later from TP-Link and apply patches to all affected routers; prioritize systems in environments with shared or untrusted administrative access. Within 30 days: Complete patch deployment across all affected devices; validate administrative access controls and review credential security for router administrative accounts.

TP-Link Archer BE230 CVE-2026-22226

Q: What is the CVSS score of CVE-2026-22226?

CVE-2026-22226 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.0%.

HIGH

OS Command Injection (CWE-78)

2026-02-02 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Command Injection

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 04, 2026 - 19:31 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 04, 2026 - 19:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 04, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jun 04, 2026 - 19:22 NVD

7.2 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

Patch released

Feb 06, 2026 - 18:27 nvd

Patch available

CVE Published

Feb 02, 2026 - 18:16 nvd

HIGH 7.2

DescriptionCVE.org

A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.

This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.

This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

AnalysisAI

Authenticated command injection in the TP-Link Archer BE230 v1.2 router (firmware prior to 1.2.4 Build 20251218 rel.70420) allows an administrator on the adjacent network to execute arbitrary OS commands via the VPN server configuration module. No public exploit identified at time of analysis, and EPSS of 0.99% (77th percentile) suggests modest near-term exploitation likelihood, though successful exploitation yields full device takeover. This CVE is one of several distinct command injection flaws disclosed across separate code paths in the same firmware.

Technical ContextAI

The affected device is the TP-Link Archer BE230, a Wi-Fi 7 (BE-class) consumer/SOHO router, identified by CPE cpe:2.3:o:tp-link:archer_be230_firmware. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where user-supplied input passed to the VPN server configuration handler in the device's web management interface is concatenated into a shell command without proper sanitization or argument separation. Such flaws are common in embedded Linux routers where CGI handlers invoke BusyBox or vendor scripts via system()/popen() with attacker-controlled parameters, enabling shell metacharacter injection that runs in the privileged context of the router's management daemon (typically root).

RemediationAI

Apply the vendor-released patch by upgrading TP-Link Archer BE230 v1.2 to firmware 1.2.4 Build 20251218 rel.70420 or later, obtained from https://www.tp-link.com/us/support/download/archer-be230/v1.20/#Firmware (regional mirrors at /en/ and /sg/), and consult the TP-Link advisory at https://www.tp-link.com/us/support/faq/4935/ for upgrade guidance. Until the firmware is applied, restrict administrative access to the web management interface to trusted wired LAN hosts only, disable remote/WAN management, and disable the VPN server feature on the router if it is not in active use, which removes the vulnerable code path at the cost of losing remote VPN connectivity. Change the admin password and rotate any pre-shared keys after patching in case the device was previously exposed, since exploitation grants full filesystem and process control that could leave residual implants surviving a configuration reset but not necessarily a full firmware reflash.