CVE-2026-22223: TP-Link Archer BE230 RCE Vulnerability

CVE-2026-22223 Overview

An OS Command Injection vulnerability (CWE-78) has been identified in the TP-Link Archer BE230 v1.2 router, specifically within its VPN modules. This vulnerability allows an adjacent authenticated attacker to execute arbitrary code on the affected device. Successful exploitation could grant an attacker full administrative control of the router, resulting in severe compromise of configuration integrity, network security, and service availability.

This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.

Critical Impact

Authenticated attackers on the adjacent network can achieve arbitrary code execution, potentially gaining full administrative control of the TP-Link router and compromising network security.

Affected Products

• TP-Link Archer BE230 v1.2 (firmware versions prior to 1.2.4 Build 20251218 rel.70420)
• TP-Link Archer BE230 v1.20 VPN modules

Discovery Timeline

• 2026-02-02 - CVE CVE-2026-22223 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-22223

Vulnerability Analysis

This OS command injection vulnerability exists in the VPN modules of the TP-Link Archer BE230 v1.2 router firmware. The vulnerability stems from improper sanitization of user-supplied input that is subsequently passed to operating system command execution functions. When an authenticated user on the adjacent network submits specially crafted input through the VPN configuration interface, the router fails to properly validate or escape shell metacharacters, allowing the injection of arbitrary OS commands.

The attack requires adjacent network access and authentication credentials, which limits the attack surface compared to remotely exploitable vulnerabilities. However, once exploited, the attacker gains the ability to execute commands with the privileges of the router's operating system, typically root-level access on embedded Linux-based devices like the Archer BE230.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the VPN module code path. User-controlled data is concatenated directly into system command strings without adequate escaping or filtering of shell metacharacters (such as ;, |, &, `, $(), etc.). This allows attackers to break out of the intended command context and inject additional commands that the system will execute.

Attack Vector

The attack vector requires adjacent network positioning, meaning the attacker must be on the same local network segment as the vulnerable router. Additionally, the attacker must possess valid authentication credentials to access the router's administrative interface where the VPN configuration modules are accessible.

Once authenticated, the attacker can craft malicious input containing OS command injection payloads targeting the vulnerable VPN module parameters. The injected commands execute with elevated privileges on the router's underlying operating system, enabling actions such as modifying router configurations, intercepting network traffic, establishing persistent backdoor access, or using the compromised router as a pivot point for further network intrusion.

The vulnerability mechanism involves passing unsanitized user input to system command execution functions. When VPN configuration parameters are processed, shell metacharacters in the input are interpreted by the underlying shell, allowing command injection. For detailed technical information, refer to the TP-Link Security FAQ.

Detection Methods for CVE-2026-22223

Indicators of Compromise

• Unexpected outbound connections from the router to external IP addresses
• Modified VPN configuration entries containing shell metacharacters or unusual command sequences
• Unexplained processes running on the router that are not part of standard firmware operations
• Changes to router configuration files or user accounts without administrator action

Detection Strategies

• Monitor router administrative interface access logs for suspicious authentication patterns or unusual configuration changes to VPN modules
• Implement network traffic analysis to detect anomalous command-and-control communications originating from the router
• Review VPN configuration parameters for injection patterns such as semicolons, pipes, backticks, or $() sequences in input fields
• Deploy network-based intrusion detection signatures targeting OS command injection attempts against TP-Link router management interfaces

Monitoring Recommendations

• Enable verbose logging on the TP-Link Archer BE230 administrative interface and forward logs to a centralized SIEM solution
• Establish baseline network behavior for the router and alert on deviations indicating potential compromise
• Periodically audit VPN module configurations for unauthorized or suspicious entries

How to Mitigate CVE-2026-22223

Immediate Actions Required

• Update the TP-Link Archer BE230 v1.2 firmware to version 1.2.4 Build 20251218 rel.70420 or later immediately
• Restrict administrative interface access to trusted hosts only using access control lists
• Review and rotate all administrative credentials for the affected router
• Audit VPN configurations for any signs of tampering or malicious entries

Patch Information

TP-Link has released firmware version 1.2.4 Build 20251218 rel.70420 which addresses this OS command injection vulnerability. The patched firmware is available for download from the official TP-Link support portal:

• TP-Link Archer BE230 Firmware Download (US)
• TP-Link Archer BE230 Firmware Download (Global)
• TP-Link Archer BE230 Firmware Download (SG)

Additional security guidance is available in the TP-Link Security FAQ.

Workarounds

• Disable VPN functionality on the router if not required until the firmware can be updated
• Implement network segmentation to isolate the router's administrative interface from untrusted network segments
• Use strong, unique credentials for administrative access and consider implementing additional authentication controls
• Monitor the router closely for signs of compromise while awaiting patch deployment

# Recommended configuration steps after firmware update
# 1. Access router admin interface and navigate to System > Firmware Upgrade
# 2. Upload the patched firmware (1.2.4 Build 20251218 rel.70420 or later)
# 3. After upgrade, review VPN module settings
# 4. Reset administrative credentials
# 5. Enable logging and configure log forwarding to SIEM