CVE-2026-22223

HighCVSS 8.0

Published: 02/02/2026(UTC)Updated: 18/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.49%

73th percentile - higher than 73% of all known CVEs

Summary

TP-Link Archer BE230 v1.2 and BE3600 v1 (VPN modules) have an OS command injection vulnerability that allows an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could give full administrative control of the device.

Risk Assessment

An attacker can gain full control of the router, potentially leading to compromise of configuration integrity, network security, and service availability.

Recommendation

Upgrade Archer BE230 firmware to version 1.2.4 Build 20251218 rel.70420 or later. Restrict access to the admin panel and VPN modules.

Other vulnerabilities in TP-Link Archer BE230

CVE-2026-0631High
TP-Link Archer BE230 v1.2, BE3600 v1, and AXE75 v1 (OpenVPN modules) have an OS command injection vulnerability that allows an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could give full administrative control of the device.

Original NVD description (English source)

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.