PT-2026-5690 · Tp Link · Archer Be230

Published 2026-02-02 · Updated 2026-02-02 · CVE-2026-22226

Positive Technologies · (AI Summary)

CVSS v4.0

8.5

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420

Description A command injection issue exists following administrator authentication within the VPN server configuration module. Successful exploitation could grant an attacker complete administrative control over the device, potentially compromising configuration integrity, network security, and service availability. The issue affects multiple code paths, each tracked under a unique identifier. The vulnerability is triggered in the VPN server configuration module.

Recommendations Update to version 1.2.4 Build 20251218 rel.70420 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-22226

Affected Products

Archer Be230

References · 7

• https://tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware · Patch
• https://tp-link.com/us/support/faq/4935 · Vendor Advisory
• https://tp-link.com/us/support/download/archer-be230/v1.20/#Firmware · Patch
• https://tp-link.com/en/support/download/archer-be230/v1.20/#Firmware · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22226 · Security Note
• https://twitter.com/CVEnew/status/2018465540839284799 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2018415166509941199 · Twitter Post