CVE-2026-22226
Published: 02 February 2026
Summary
CVE-2026-22226 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Archer Be230 Firmware. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22226 is a command injection vulnerability (CWE-78) that can be exploited after administrative authentication in the VPN server configuration module of the TP-Link Archer BE230 v1.2 router. It affects versions prior to 1.2.4 Build 20251218 rel.70420. Published on 2026-02-02, this CVE tracks one of multiple distinct OS command injection issues identified across separate code paths in the device firmware, with each instance assigned a unique CVE ID. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
An authenticated administrator with network access to the device can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary OS commands, potentially gaining full administrative control of the router. This results in severe compromise of configuration integrity, network security, and service availability.
TP-Link advisories direct users to download updated firmware for the Archer BE230 v1.20 from regional support pages to mitigate the issue. Additional mitigation details are provided in the manufacturer's support FAQ at https://www.tp-link.com/us/support/faq/4935/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5089
Vulnerability details
A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation could allow an attacker to gain full administrative control of the device,…
more
resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Archer AX73 v2 < 1.3.1 Build 20260430.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing router config module enables T1190 exploitation and arbitrary OS command execution via T1059.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of inputs in the VPN configuration module to block OS command injection strings.
Mandates timely application of the vendor firmware patch (v1.2.4 Build 20251218) that eliminates the command-injection flaw.
Enforces disabling or restricting the VPN server configuration feature when not required, reducing the exposed attack surface.