Command Injection Vulnerability in TP-Link Archer BE230 Device
CVE-2026-22224
8.5HIGH
Key Information:
- Vendor
Tp-link Systems Inc.
- Status
- Vendor
- CVE Published:
- 2 February 2026
What is CVE-2026-22224?
A command injection vulnerability exists in the cloud communication interface of the TP-Link Archer BE230 v1.2. This flaw can be exploited post-admin authentication, enabling an attacker to execute arbitrary commands. Successful exploitation compromises the device's configuration, network security, and overall service availability, posing a significant risk to users. Each occurrence of this type of vulnerability across various code paths is documented under its own identifier.
Affected Version(s)
Archer BE230 v1.2 0 < 1.2.4 Build 20251218 rel.70420