An authenticated user with high privileges can trigger a denial‑of‑service on TP‑Link Archer BE230 by restoring a configuration file that contains an excessively long parameter. The restoration overflows internal buffers, rendering the router unresponsive until it is rebooted. The flaw is an input‑validation vulnerability, classified as CWE‑400, and limits availability to the affected device during the unresponsive period.

TP‑Link Archer BE230 devices running firmware before version 1.2.4 Build 20251218 rel.70420 are vulnerable. Any device operating on firmware images older than this build, such as the v1.2 series, must be addressed.

The CVSS score of 6.8 places this vulnerability in the Medium severity range, while the EPSS score of less than 1% signals a very low current exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access with administrative privileges, implying an internal or compromised configuration model rather than an unauthenticated network attack. The risk therefore concentrates on environments where privileged users can upload configuration files to an unpatched router.