Command Injection Vulnerability in TP-Link Archer BE230 Router
CVE-2026-22226
8.5HIGH
Key Information:
- Vendor
Tp-link Systems Inc.
- Vendor
- CVE Published:
- 2 February 2026
What is CVE-2026-22226?
A command injection vulnerability exists in the VPN server configuration module of the TP-Link Archer BE230 v1.2, which can be exploited after administrative authentication. This flaw allows an attacker to execute arbitrary commands, potentially granting full administrative control over the router. As a result, the integrity of the device's configuration, network security posture, and service availability are at significant risk. Affected users are encouraged to apply the latest firmware updates to mitigate this vulnerability.
Affected Version(s)
Archer AX73 v2 0 < 1.3.1 Build 20260430
Archer BE230 v1.2 0 < 1.2.4 Build 20251218 rel.70420