CVE-2026-22221: Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent
authenticated
attacker
execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.
This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.
This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TP-Link Archer BE230to a version that resolves this vulnerability.Fixed in 1.2.4Patch Build 20251218 rel.70420
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22221?
CVE-2026-22221 is considered a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2026-22221?
To fix CVE-2026-22221, update the TP-Link Archer BE230 to the latest firmware version that has addressed this vulnerability.
Who is affected by CVE-2026-22221?
The CVE-2026-22221 vulnerability affects users of the TP-Link Archer BE230 version 1.2.4 Build 20251218.
What are the risks associated with CVE-2026-22221?
Exploiting CVE-2026-22221 can allow an attacker to execute arbitrary commands, potentially leading to full administrative control of the device.
Is CVE-2026-22221 an authenticated vulnerability?
Yes, CVE-2026-22221 requires an adjacent authenticated attacker to exploit the command injection vulnerability.