CVE-2026-0630
Published: 02 February 2026
Summary
CVE-2026-0630 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Archer Be230 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely flaw remediation through firmware updates that directly patch the OS command injection vulnerability in the TP-Link router web modules.
Mandates validation of untrusted inputs to web modules to prevent OS command injection exploitation by adjacent authenticated attackers.
Verifies integrity of firmware and software to detect unauthorized modifications from command injection and ensure only patched versions execute.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in web interface directly enables exploitation of the application for RCE (T1190) and arbitrary Unix shell command execution (T1059.004) on the Linux-based router.
NVD Description
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe…
more
compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Archer AXE v1.0 < 1.5.3 Build 20260209 rel. 71108.
Deeper analysisAI
CVE-2026-0630 is an OS command injection vulnerability (CWE-78) affecting the web modules in TP-Link Archer BE230 v1.2 and Archer AXE75 v1.0 routers. The issue exists in Archer BE230 v1.2 versions prior to 1.2.4 Build 20251218 rel.70420 and Archer AXE75 v1.0 versions prior to 1.5.3 Build 20260209 rel.71108. This CVE tracks one of multiple distinct OS command injection flaws identified across separate code paths in these devices, with each instance assigned a unique CVE ID. The vulnerability has a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An adjacent authenticated attacker with low privileges can exploit this vulnerability to execute arbitrary operating system commands on the affected device. Successful exploitation grants full administrative control, enabling severe impacts such as complete compromise of device configuration integrity, network security, and service availability.
TP-Link advisories provide firmware updates as the primary mitigation, available via download pages for the Archer BE230 v1.2 and Archer AXE75 v1.0 models on regional support sites including tp-link.com, tp-link.com/sg, and tp-link.com/us. Security practitioners should verify and apply the specified fixed builds to remediate the issue.
Details
- CWE(s)