CVE-2026-22224
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-02-02

Last updated on: 2026-02-06

Assigner: TPLink

Description
A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-02
Last Modified
2026-02-06
Generated
2026-05-07
AI Q&A
2026-02-02
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
tp-link archer_be230_firmware to 1.2.4 (exc)
tp-link archer_be230 1.20
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a command injection flaw in the cloud communication interface of the TP-Link Archer BE230 v1.2 router. It can be exploited after an admin has authenticated, allowing an attacker to execute arbitrary OS commands on the device. This could lead to the attacker gaining full administrative control over the router.


How can this vulnerability impact me? :

Exploitation of this vulnerability could result in an attacker gaining full administrative control of the affected device. This can severely compromise the device's configuration integrity, network security, and service availability, potentially allowing unauthorized access, disruption of network services, or manipulation of network traffic.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart