PT-2026-5685 · Tp Link · Archer Be230

CVE-2026-22221 · Publicado 2026-02-02 · Atualizado 2026-02-03

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420

Description An OS Command Injection issue exists in TP-Link Archer BE230. A nearby authenticated attacker can execute arbitrary code. Successful exploitation may allow an attacker to gain full administrative control of the device, potentially compromising configuration integrity, network security, and service availability. This issue is present in the vpn modules.

Recommendations Update to version 1.2.4 Build 20251218 rel.70420 or later.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2026-02132

CVE-2026-22221

Produtos afetados

Archer Be230

Referências · 11

• https://tp-link.com/en/support/download/archer-be230/v1.20/#Firmware · Correção
• https://tp-link.com/us/support/download/archer-be230/v1.20/#Firmware · Correção
• https://tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware · Correção
• https://twitter.com/VulmonFeeds/status/2018425404218827236 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22221 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22221 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-02132 · Nota de Segurança
• https://tp-link.com/us/support/faq/4935 · Aviso do Fabricante, Correção
• https://twitter.com/CVEnew/status/2018465548040839295 · Publicação no Twitter
• https://t.me/CVEtracker/43525 · Publicação no Telegram
• https://tp-link.com/us/support/download/archer-be230/v1.20/#FirmwareTPLink · Nota