Cyber Posture

CVE-2026-22226

HighRCE

Published: 02 February 2026

Published
02 February 2026
Modified
06 February 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0086 75.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22226 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Archer Be230 Firmware. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Command injection in public-facing router config module enables T1190 exploitation and arbitrary OS command execution via T1059.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe…

more

compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

Deeper analysisAI

CVE-2026-22226 is a command injection vulnerability (CWE-78) that can be exploited after administrative authentication in the VPN server configuration module of the TP-Link Archer BE230 v1.2 router. It affects versions prior to 1.2.4 Build 20251218 rel.70420. Published on 2026-02-02, this CVE tracks one of multiple distinct OS command injection issues identified across separate code paths in the device firmware, with each instance assigned a unique CVE ID. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

An authenticated administrator with network access to the device can exploit this vulnerability remotely with low complexity and no user interaction required. Successful exploitation allows the attacker to execute arbitrary OS commands, potentially gaining full administrative control of the router. This results in severe compromise of configuration integrity, network security, and service availability.

TP-Link advisories direct users to download updated firmware for the Archer BE230 v1.20 from regional support pages to mitigate the issue. Additional mitigation details are provided in the manufacturer's support FAQ at https://www.tp-link.com/us/support/faq/4935/.

Details

CWE(s)

Affected Products

tp-link
archer be230 firmware
≤ 1.2.4

CVEs Like This One

CVE-2026-0630Same product: Tp-Link Archer Be230
CVE-2026-22225Same product: Tp-Link Archer Be230
CVE-2026-22221Same product: Tp-Link Archer Be230
CVE-2026-22224Same product: Tp-Link Archer Be230
CVE-2026-22229Same product: Tp-Link Archer Be230
CVE-2026-22227Same product: Tp-Link Archer Be230
CVE-2026-0631Same product: Tp-Link Archer Be230
CVE-2026-22222Same product: Tp-Link Archer Be230
CVE-2026-22223Same product: Tp-Link Archer Be230
CVE-2024-57357Same vendor: Tp-Link

References