CVE-2026-22222

Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v2

View on CVE.org
Published Feb 2, 2026 CVSS 4.0 · 8.5 High EPSS 1.6% KEV · Not listed
Description
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent

authenticated

attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.

This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.

Analysis

AI-generated

Technical impact

The vulnerability is an operating‑system command injection in the web modules of TP‑Link Archer BE230 v1.2 and Archer AXE75 v2 routers. An attacker who can authenticate from a nearby network segment can supply crafted input that causes the firmware to execute arbitrary OS commands with root privileges, giving the attacker full administrative control. Successful exploitation could allow configuration tampering, accidental or intentional denial‑of‑service, and compromise of network security.

Affected Systems

Devices employing TP‑Link Archer BE230 v1.2 firmware or TP‑Link Archer AXE75 v2 firmware are affected. No specific firmware revision numbers are supplied in the data, so all builds belonging to the v1.2 and v2 families are potentially vulnerable.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, while the EPSS score of 2% shows that the likelihood of exploitation is currently low but not negligible. The attack requires that the attacker have authenticated access from an adjacent network, a common scenario for devices exposed on untrusted or guest networks. The vulnerability is not listed in CISA’s KEV catalog, but the combination of local authentication and remote code execution makes it a critical risk if a foothold is gained.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to the newest available release from TP‑Link’s support site, ensuring the firmware is not a v1.2 or v2 version that contains the vulnerability.
  • Restrict web‑based management interfaces to trusted internal networks or VPN tunnels, disabling external access when not required.
  • Enforce strong, unique passwords for all administrative accounts to limit the risk of an authenticated attacker. If an immediate firmware update is not possible, block inbound traffic to the web‑management ports (80/443) from untrusted sources and monitor for anomalous command execution attempts.

Generated by OpenCVE AI on October 17, 2026 at 10:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420. An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.
Title Command Injection Vulnerability on TP-Link Archer BE230 v1.2 Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and AXE75 v2
References
Type Values Removed Values Added
First Time appeared Tp-link archer Be230 Firmware
CPEs cpe:2.3:h:tp-link:archer_be230:1.20:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:archer_be230_firmware:*:*:*:*:*:*:*:*
Vendors & Products Tp-link archer Be230 Firmware
Metrics cvssV3_1

{'score': 8.0, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
First Time appeared Tp-link
Tp-link archer Be230
Vendors & Products Tp-link
Tp-link archer Be230
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
Title Command Injection Vulnerability on TP-Link Archer BE230 v1.2
Weaknesses CWE-78
References
Metrics cvssV4_0

{'score': 8.5, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
TPLink
Published
Updated
Oct 14, 2026, 9:14 PM
Reserved
Jan 6, 2026, 6:18 PM

View source JSON

Updated
Feb 2, 2026, 6:52 PM

JSON

Status
Modified
Published
Feb 2, 2026, 6:16 PM
Modified
Oct 14, 2026, 10:17 PM

View source JSON

No data.

Updated
Oct 17, 2026, 11:00 AM

JSON