Command Injection Vulnerability in Archer VPN Connection Service

CVE-2026-22225

What is CVE-2026-22225?

A command injection vulnerability exists in the VPN Connection Service of the TP-Link Archer BE230 device. This flaw can be exploited post-authentication, enabling attackers to take full administrative control over the device. The exploitation of this vulnerability could lead to significant risks, including compromising configuration integrity, undermining network security, and causing disruptions in service availability. Immediate action is advised for users operating on affected firmware versions to ensure their devices remain secure.

References