CVE-2026-0630: TP-Link Archer Router RCE Vulnerability

CVE-2026-0630 Overview

CVE-2026-0630 is an OS command injection vulnerability [CWE-78] affecting TP-Link Archer BE230 and Archer AXE75 wireless routers. The flaw resides in the web management modules and allows an authenticated attacker on an adjacent network to execute arbitrary operating system commands. Successful exploitation grants full administrative control of the device, compromising configuration integrity, network security, and service availability.

This CVE represents one of several distinct command injection issues identified across separate code paths in the affected firmware. TP-Link has released firmware updates that address the vulnerability.

Critical Impact

An adjacent authenticated attacker can execute arbitrary OS commands on the router, gain full administrative control, and pivot to attack other devices on the local network.

Affected Products

• TP-Link Archer BE230 v1.2 firmware prior to 1.2.4 Build 20251218 rel.70420
• TP-Link Archer AXE75 v1.0 firmware prior to 1.5.3 Build 20260209 rel.71108
• TP-Link Archer BE230 hardware revision 1.20

Discovery Timeline

• 2026-02-02 - CVE-2026-0630 published to the National Vulnerability Database
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-0630

Vulnerability Analysis

The vulnerability is classified as an Improper Neutralization of Special Elements used in an OS Command [CWE-78]. The web management interface of the Archer BE230 and Archer AXE75 routers passes user-supplied input from web modules into operating system command execution functions without proper sanitization. An attacker who has authenticated to the device and is positioned on an adjacent network — typically the same Wi-Fi or LAN segment — can inject shell metacharacters into vulnerable parameters to execute commands with the privileges of the web service.

Because the web service on consumer-grade TP-Link routers typically runs with root or equivalent privileges, successful exploitation results in full device takeover. The attacker can modify firewall rules, alter DNS settings, install persistent backdoors, capture traffic, or use the router as a foothold for lateral movement.

Root Cause

The root cause is missing input validation and unsafe construction of shell command strings inside one or more web module handlers. User-controlled values are concatenated into commands passed to a system shell rather than being validated against an allowlist or executed through parameterized APIs that avoid shell interpretation.

Attack Vector

Exploitation requires adjacent network access and valid administrative credentials. The attacker authenticates to the router web interface and submits a crafted HTTP request to a vulnerable web module endpoint. The injected payload — including characters such as ;, |, &, or backticks — is incorporated into a shell command and executed by the underlying operating system. No user interaction is required beyond the attacker's own actions. See the TP-Link FAQ on Security for vendor guidance.

No public proof-of-concept exploit code is currently available for this vulnerability.

Detection Methods for CVE-2026-0630

Indicators of Compromise

• Unexpected outbound connections originating from the router management plane to unknown hosts.
• Unauthorized changes to router configuration such as DNS server settings, port forwarding rules, or administrator accounts.
• New or modified processes running on the device that do not match the firmware baseline.
• Authentication events to the router web interface from unusual internal client addresses or at unusual times.

Detection Strategies

• Monitor router system logs and syslog forwarding for command execution traces, failed authentications, and configuration changes.
• Inspect HTTP requests directed at the router management interface for shell metacharacters such as ;, &&, |, and $() in POST bodies and query parameters.
• Compare current firmware version and configuration hash against a known-good baseline to identify tampering.

Monitoring Recommendations

• Forward router logs to a centralized logging or SIEM platform and alert on configuration modifications and administrative logins.
• Use network traffic analysis to flag anomalous DNS redirection, unusual upstream traffic, or scanning behavior originating from router IP addresses.
• Restrict access to the router management interface to a dedicated management VLAN and monitor that segment for unauthorized clients.

How to Mitigate CVE-2026-0630

Immediate Actions Required

• Upgrade Archer BE230 to firmware 1.2.4 Build 20251218 rel.70420 or later, and Archer AXE75 to firmware 1.5.3 Build 20260209 rel.71108 or later.
• Change the router administrator password and disable any default or shared credentials.
• Disable remote management over WAN and restrict web interface access to trusted internal hosts.
• Audit router configuration for unauthorized changes to DNS, firewall, port forwarding, and administrator accounts.

Patch Information

TP-Link has released fixed firmware for both affected models. Download the updates from the official product pages: TP-Link Archer BE230 Firmware and TP-Link Archer AXE75 Firmware. Additional vendor guidance is available in the TP-Link FAQ on Security.

Workarounds

• Place the router management interface on an isolated VLAN and restrict access using firewall rules until firmware is updated.
• Disable Wi-Fi guest networks and any features that allow untrusted users to obtain Layer 2 adjacency to the management interface.
• Enforce strong, unique administrator credentials and enable account lockout if supported by the device.

# Configuration example: restrict management access to a trusted host
# (run from a trusted admin workstation; adapt to your network)
# 1. Confirm running firmware version via the router web UI or CLI
# 2. Apply ACL to limit HTTP/HTTPS management to a single admin IP
ip http access-class permit host 192.0.2.10
ip http secure-server
no ip http server