CVE-2026-22227
Published: 02 February 2026
Summary
CVE-2026-22227 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Archer Be230 Firmware. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-22227 is a command injection vulnerability (CWE-78) in the configuration backup restoration function of the TP-Link Archer BE230 v1.2 router firmware. It affects versions prior to 1.2.4 Build 20251218 rel.70420 and represents one of multiple distinct OS command injection issues across separate code paths in the device, each tracked under a unique CVE ID. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
Exploitation requires an attacker to first authenticate as an administrator (PR:H), after which they can leverage the backup restoration feature over the network (AV:N) with low complexity and no user interaction. Successful exploitation grants full administrative control of the device, enabling severe compromise of configuration integrity, network security, and service availability.
TP-Link advisories recommend updating to firmware version 1.2.4 Build 20251218 rel.70420 or later, available via regional download pages such as those for the US, global, and Singapore sites. Additional guidance is provided in TP-Link's FAQ 4935.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5084
Vulnerability details
A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe…
more
compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-78 OS command injection in authenticated backup restore function directly enables arbitrary Unix shell command execution on the router firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor firmware patch (1.2.4 Build 20251218) that eliminates the command-injection flaw in the backup-restoration code path.
Mandates validation and sanitization of all input supplied to the configuration backup restoration function, blocking the OS command injection (CWE-78) before it can be executed.
Enforces access restrictions and authorization checks specifically for configuration-change operations such as backup restoration, limiting the post-authentication attack surface to only trusted administrators.