What is the CVSS score of CVE-2026-22229?

CVE-2026-22229 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-22229?

Within 24 hours: Identify and inventory all affected TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 devices in your environment. Within 7 days: Apply the available vendor patch to all identified devices and verify successful deployment. Within 30 days: Implement administrative controls restricting VPN configuration file imports to authorized personnel only and conduct access reviews of administrative accounts.

Archer Be230 Firmware CVE-2026-22229

Q: Which versions of Archer Be230 Firmware are affected by CVE-2026-22229?

A command injection vulnerability in TP-Link Archer BE230 and Deco BE25 devices allows authenticated administrators to execute arbitrary commands via malicious VPN configuration files.. A patch is available.

HIGH

OS Command Injection (CWE-78)

2026-02-02 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Command Injection Archer Be230 Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

Patch released

Mar 02, 2026 - 18:16 nvd

Patch available

CVE Published

Feb 02, 2026 - 18:16 nvd

HIGH 7.2

DescriptionCVE.org

A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Deco BE25 v1.0: through 1.1.1 Build 20250822.

AnalysisAI

Command injection in TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 allows authenticated administrators to execute arbitrary OS commands by importing a malicious VPN configuration file. An attacker with admin access can achieve full device compromise, affecting network configuration, security posture, and service availability. Affected versions require patching to build 20251218 rel.70420 (BE230) or 20250822 (BE25).

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Archer Be230 Firmware. A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code pa