CVE-2026-22225: Archer BE230 RCE Vulnerability

CVE-2026-22225 Overview

CVE-2026-22225 is a command injection vulnerability affecting the VPN Connection Service on the TP-Link Archer BE230 v1.2 router. This vulnerability can be exploited after administrative authentication, allowing an authenticated attacker to execute arbitrary operating system commands on the affected device. Successful exploitation could result in complete administrative control of the router, severely compromising configuration integrity, network security, and service availability.

This CVE represents one of multiple distinct OS command injection issues identified across separate code paths in the affected firmware. Although similar in nature, each instance is tracked under a unique CVE ID.

Critical Impact
Authenticated attackers with admin access can execute arbitrary OS commands, leading to full device compromise, network infiltration, and potential lateral movement across connected systems.

Affected Products

TP-Link Archer BE230 v1.2 firmware versions prior to 1.2.4 Build 20251218 rel.70420

Discovery Timeline

2026-02-02 - CVE-2026-22225 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-22225

Vulnerability Analysis

This command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) resides in the VPN Connection Service component of the TP-Link Archer BE230 v1.2 router firmware. The vulnerability requires prior administrative authentication, meaning an attacker must first possess valid admin credentials or compromise an admin session before exploitation is possible.

Once authenticated, the attacker can inject malicious OS commands through the VPN Connection Service interface. The underlying firmware fails to properly sanitize or validate user-supplied input before incorporating it into system-level command execution, allowing arbitrary command injection. This attack vector is accessible from the adjacent network, meaning attackers must have local network access to reach the router's management interface.

Root Cause

The root cause of CVE-2026-22225 is improper input validation in the VPN Connection Service code path. User-controlled input is passed directly to shell command execution functions without adequate sanitization or escaping of special characters. This allows metacharacters and command separators (such as ;, |, &&, or backticks) to break out of the intended command context and execute attacker-supplied commands with the privileges of the router's operating system.

Attack Vector

The attack requires the following conditions:

Adjacent Network Access: The attacker must have access to the same network segment as the target router, either through direct connection or via a compromised internal device
Administrative Authentication: Valid admin credentials are required, which could be obtained through credential theft, default password exploitation, or session hijacking
VPN Connection Service Access: The attacker must interact with the VPN Connection Service configuration interface to inject malicious commands

Once these conditions are met, the attacker can craft malicious input containing OS command injection payloads. The vulnerability allows execution of arbitrary commands with the privileges of the router's underlying operating system, typically root-level access on embedded Linux systems.

The exploitation mechanism involves injecting shell metacharacters into input fields processed by the VPN Connection Service. When the firmware constructs and executes system commands using this unsanitized input, the injected commands are executed alongside or instead of the intended operations. For detailed technical information, refer to the TP-Link FAQ on Device.

Detection Methods for CVE-2026-22225

Indicators of Compromise

Unexpected outbound connections from the router to external command-and-control servers
Unusual processes or services running on the router that are not part of standard firmware
Modified router configuration settings, particularly in VPN-related sections
Presence of unauthorized user accounts or SSH keys on the device
Anomalous network traffic patterns originating from the router's management interface

Detection Strategies

Monitor administrative login attempts and successful authentications to the router's web interface for unusual patterns or timing
Implement network-level monitoring to detect command-and-control communications from router IP addresses
Review router system logs for unusual command execution patterns or error messages related to the VPN Connection Service
Deploy network intrusion detection systems (IDS) with signatures for common command injection payloads

Monitoring Recommendations

Enable and centralize logging for all router administrative activities
Configure alerts for multiple failed authentication attempts followed by successful login
Monitor for configuration changes to VPN settings outside of approved change windows
Implement network segmentation to limit exposure of router management interfaces

How to Mitigate CVE-2026-22225

Immediate Actions Required

Update the TP-Link Archer BE230 v1.2 firmware to version 1.2.4 Build 20251218 rel.70420 or later immediately
Restrict administrative access to the router by limiting management interface accessibility to trusted hosts only
Ensure strong, unique administrative passwords are configured and rotate credentials if compromise is suspected
Disable remote management features if not required for operations
Audit existing VPN configurations for any unauthorized or suspicious entries

Patch Information

TP-Link has released firmware version 1.2.4 Build 20251218 rel.70420 that addresses this command injection vulnerability. The updated firmware is available for download from the official TP-Link support portal. Organizations should prioritize applying this patch to all affected Archer BE230 v1.2 devices.

Download the patched firmware from the TP-Link Firmware Download page.

Workarounds

Implement network-level access controls to restrict which hosts can reach the router's administrative interface
Place the router's management interface on a dedicated, isolated management VLAN
Deploy additional authentication mechanisms such as VPN-only access to management functions
Monitor and log all administrative access attempts pending firmware update deployment

bash

# Configuration example - Restrict management access (example for firewall rules)
# Block external access to router management ports
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP

# Allow management only from specific admin workstation
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.100 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.100 -j ACCEPT