CVE-2026-22222CWE-78command-injection

CVE-2026-22222

High · published February 2, 2026

CVSS v3.1
8.0
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

⚡ An authenticated attacker can unleash chaos with just a few commands in the TP-Link Archer BE230 v1.2! 💥 Picture a hotel concierge who can access every guest's room with just a secret code. This OS Command Injection vulnerability lets an attacker command the device like a rogue concierge with undue access, potentially compromising the entire network. If exploited, an attacker could gain full administrative control of the device, leading to a complete takeover of its configuration and network security. This could mean unauthorized access to sensitive data, disruption of services, and a significant breach of trust within your network environment. The consequences could be absolutely devastating!

Put simply

Picture a hotel concierge who can access every guest's room with just a secret code. This OS Command Injection vulnerability lets an attacker command the device like a rogue concierge with undue access, potentially compromising the entire network. This vulnerability allows an adjacent authenticated attacker to execute arbitrary commands on the TP-Link Archer BE230 v1.2. By exploiting this OS command injection flaw, they can manipulate the device's functions and settings, gaining administrative privileges without proper authorization.

What to do

If exploited, an attacker could gain full administrative control of the device, leading to a complete takeover of its configuration and network security. This could mean unauthorized access to sensitive data, disruption of services, and a significant breach of trust within your network environment. The consequences could be absolutely devastating! Update your TP-Link Archer BE230 to version 1.2.4 Build 20251218 rel.70420 immediately to close this vulnerability. Regularly review logs for any suspicious activities and ensure proper network segmentation to limit access. Don't forget to monitor for any unusual device behavior! You've got this! Take these steps, and you'll be well on your way to securing your network like a pro! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01573 · 75.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-02-02T23:16Z
Affected products (1)
ProductVersionsFixed in
tp-link/archer_be230_firmware< 1.2.41.2.4
References (6)
EPSS history
Timeline
  • 02 FEB 17:49Z
    Command Injection Vulnerability on TP-Link Archer BE230 v1.2
    cvelistv5