CVE-2026-22223: Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and BE3600 v1
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent
authenticated
attacker
execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.
This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.
This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TP-Link Archer BE230 (vpn modules)to a version that resolves this vulnerability.Fixed in 1.2.4Patch Build 20251218 rel.70420
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22223?
CVE-2026-22223 is classified as a critical command injection vulnerability that can lead to complete administrative control.
How do I fix CVE-2026-22223?
To mitigate CVE-2026-22223, update the firmware of the TP-Link Archer BE230 to the latest version.
Who is affected by CVE-2026-22223?
CVE-2026-22223 affects TP-Link Archer BE230 devices running firmware version up to 1.2.4.
What type of vulnerability is CVE-2026-22223?
CVE-2026-22223 is a command injection vulnerability found in the TP-Link Archer BE230.
What can an attacker do with CVE-2026-22223?
An attacker exploiting CVE-2026-22223 can execute arbitrary commands and gain full control over the device.