CVE-2026-22229Disclosure(tp-link / archer_be230)

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch tp-link archer_be230 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Deco BE25 v1.0: through 1.1.1 Build 20250822.

tp-link CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

https://www.tp-link.com/us/support/faq/4935/

Other references

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

archer_be230
archer_be230_firmware

Threat summary

Patch or workaround signal is available
5 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 2 classified signals
Peaked 3d ago at 2 mentions (2026-02-02); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

tp-link

Products

archer_be230archer_be230_firmware

1 version affected across 2 products

Deep dive

Activity timeline5 mentions / 4d

Signal classification3 categories

Disclosure

240.0%

General

240.0%

Patch

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-02	2	Disclosure2
2026-02-04	1	Patch1
2026-02-10	1	General1
2026-03-02	1	General1

Full discourse5 posts

kokumօtօ@__kokumoto246d
Patch
TP-Link社の無線LANルータArcher BE230でコマンドインジェクション脆弱性10件が修正。CVE-2026-0630、CVE-2026-0631、CVE-2026-22221からCVE-2026-22227、CVE-2026-22229。要認証だが機器の乗っ取り/rootへの昇格が可能。 https://securityonline.info/rooted-via-wi-fi-7-tp-link-patches-command-injection-in-archer-be230/
Post summary
TP‑Link Archer BE230 routers were found to have ten command‑injection CVEs; patches have been released and authentication is required but root‑level compromise is possible.
030711.1K
7.2K followersView on X
CERT-PY@CERTpy240d
General
⚠️ Vulnerabilidades en productos TP-Link ❗ CVE-2026-22229 ❗ CVE-2026-0631 ❗ CVE-2026-0630 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-tp-link-4/ https://t.co/KEt0W4QnLo
Post summary
The tweet lists three TP-Link CVE identifiers and provides a link for more information, but offers no details on exploitation, patches, or technical aspects.
00010112
6.6K followersView on X
David@DavidMarquet19220d
General
📌 Top CVEs recientes (CVSS>=7.0): 1. 🛡️ CVE-2026-25221 (CVSS: 8.1) 2. ⚠️ CVE-2026-25134 (CVSS: 8.8) 3. ⚠️ CVE-2026-23515 (CVSS: 9.9) 4. 🕷️ CVE-2025-13096 (CVSS: 7.1) 5. ⚠️ CVE-2026-22229 (CVSS: 7.2) #CyberSecurity #CVE #Infosec
Post summary
The text lists several recent CVEs with high CVSS scores but provides no additional details on exploitation, patches, or technical specifics.
0000076
167 followersView on X
CVE@CVEnew247d
Disclosure
CVE-2026-22229 A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE… https://www.cve.org/CVERecord?id=CVE-2026-22229
Post summary
CVE-2026-22229 is a command injection flaw in TP‑Link Archer BE that can be triggered by importing a crafted VPN client configuration file after administrative authentication.
00000174
56.5K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds248d
Disclosure
CVE-2026-22229 Command Injection Vulnerability in TP-Link Archer BE230 v1.2 Allo... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22229 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet announces CVE-2026-22229, a command injection vulnerability affecting TP‑Link Archer BE230 v1.2, and provides links to detailed vulnerability information and alert subscriptions.
0000067
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	archer_be230	1.20	-	-
OS	tp-link	archer_be230_firmware	-	-	-

Explore more

Back to dashboard tp-link CVEs archer_be230 vulnerabilities

What researchers are saying

CVE-2026-22229

kokumօtօ[verified]@__kokumotoPatch

TP‑Link Archer BE230 routers were found to have ten command‑injection CVEs; patches have been released and authentication is required but root‑level compromise is possible.

CERT-PY@CERTpyGeneral

The tweet lists three TP-Link CVE identifiers and provides a link for more information, but offers no details on exploitation, patches, or technical aspects.

David@DavidMarquet19General

The text lists several recent CVEs with high CVSS scores but provides no additional details on exploitation, patches, or technical specifics.

CVE@CVEnewDisclosure

CVE-2026-22229 is a command injection flaw in TP‑Link Archer BE that can be triggered by importing a crafted VPN client configuration file after administrative authentication.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces CVE-2026-22229, a command injection vulnerability affecting TP‑Link Archer BE230 v1.2, and provides links to detailed vulnerability information and alert subscriptions.