CVE-2026-22225
BaseFortify
Publication date: 2026-02-02
Last updated on: 2026-03-19
Assigner: TPLink
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp-link | archer_be230_firmware | to 1.2.4 (exc) |
| tp-link | archer_be230 | 1.20 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Archer BE230 device firmware to version 1.2.4 Build 20251218 rel.70420 or later, as this version addresses the command injection issue. Additionally, restrict administrative access to trusted users only and monitor for any unauthorized administrative activity.
Can you explain this vulnerability to me?
This vulnerability is a command injection issue in the VPN Connection Service on the Archer BE230 v1.2 devices before version 1.2.4. After an admin authenticates, an attacker could exploit this flaw to execute arbitrary OS commands on the device. This could lead to the attacker gaining full administrative control over the device.
How can this vulnerability impact me? :
Exploitation of this vulnerability could allow an attacker to take full administrative control of the affected device. This can severely compromise the device's configuration integrity, network security, and availability of services, potentially disrupting network operations and exposing sensitive data.