PT-2026-5686 · Tp Link · Archer Be230

Sunshinefactory · Published 2026-02-02 · Updated 2026-02-03 · CVE-2026-22222

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420

Description An OS Command Injection issue exists in TP-Link Archer BE230 devices. A nearby, authenticated attacker can execute arbitrary code. Successful exploitation could grant an attacker full administrative control, compromising configuration integrity, network security, and service availability. This vulnerability affects web modules within the device.

Recommendations Update to version 1.2.4 Build 20251218 rel.70420 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-02133

CVE-2026-22222

Affected Products

Archer Be230

References · 10

• https://tp-link.com/en/support/download/archer-be230/v1.20/#Firmware · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22222 · Security Note
• https://tp-link.com/us/support/download/archer-be230/v1.20/#Firmware · Patch
• https://tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware · Patch
• https://bdu.fstec.ru/vul/2026-02133 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22222 · Vendor Advisory
• https://twitter.com/CVEnew/status/2018465545054535955 · Twitter Post
• https://t.me/CVEtracker/43526 · Telegram Post
• https://tp-link.com/us/support/faq/4935 · Vendor Advisory, Patch
• https://tp-link.com/us/support/download/archer-be230/v1.20/#FirmwareTPLink · Note