CVE-2026-22229: TP-Link Archer BE230 RCE Vulnerability

CVE-2026-22229 Overview

CVE-2026-22229 is an authenticated operating system command injection vulnerability affecting TP-Link Archer BE230 and Deco BE25 routers. The flaw resides in the VPN client configuration import functionality. An authenticated administrator can supply a crafted configuration file that injects shell commands executed by the underlying operating system. Successful exploitation grants full administrative control of the device, compromising configuration integrity, network security, and service availability. The issue is tracked under CWE-78 and is one of several related OS command injection issues identified across separate code paths in the affected firmware, each assigned a unique CVE.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on affected TP-Link routers by importing a crafted VPN client configuration file, leading to complete device takeover.

Affected Products

TP-Link Archer BE230 v1.2, firmware versions prior to 1.2.4 Build 20251218 rel.70420
TP-Link Deco BE25 v1.0, firmware versions through 1.1.1 Build 20250822
TP-Link Archer BE230 firmware (CPE: cpe:2.3:o:tp-link:archer_be230_firmware:*:*:*:*:*:*:*:*)

Discovery Timeline

2026-02-02 - CVE-2026-22229 published to NVD
2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-22229

Vulnerability Analysis

The vulnerability is an OS command injection issue (CWE-78) in the VPN client configuration import workflow on the TP-Link Archer BE230 and Deco BE25. When an administrator uploads a VPN client configuration file through the management interface, the firmware parses fields from that file and incorporates them into a shell command without adequate sanitization. Attacker-controlled values are passed to a system shell, allowing shell metacharacters such as semicolons, backticks, or $() substitutions to break out of the intended argument context. The injected commands execute with the privileges of the firmware process handling the import, which typically runs as root on consumer router platforms. This makes the bug a direct path to full device compromise once administrative authentication is achieved.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The VPN configuration parser concatenates user-supplied values into a command string and dispatches it through a shell interpreter rather than using parameterized execution or a strict allowlist of expected characters.

Attack Vector

The attack vector is network-based but requires high privileges, specifically valid administrator credentials for the router's management interface. An attacker who has obtained admin credentials through phishing, credential reuse, weak default passwords, or a prior bypass can deliver a malicious VPN client configuration file via the standard import feature. No user interaction beyond the attacker's own administrative session is required. The post-authentication nature limits opportunistic exploitation but is significant in scenarios where router administration is exposed, shared, or where credentials have been previously compromised.

No verified public proof-of-concept code is available at the time of writing. Refer to the TP-Link FAQ #4935 advisory for vendor guidance.

Detection Methods for CVE-2026-22229

Indicators of Compromise

Unexpected VPN client configuration imports recorded in the router's administrative event log, particularly from unfamiliar source IP addresses.
New or modified administrator accounts, altered DNS settings, or unexpected port forwarding rules appearing after a configuration import event.
Outbound connections from the router to unknown infrastructure, which may indicate post-exploitation command-and-control activity.

Detection Strategies

Inspect router system logs (where available via syslog forwarding) for VPN configuration import actions correlated with administrative logins from unusual geographies or times.
Monitor management plane access to the router admin interface and alert on configuration changes that follow a login from a new source.
Compare current firmware build identifiers against the fixed builds 1.2.4 Build 20251218 rel.70420 for Archer BE230 and post-1.1.1 Build 20250822 for Deco BE25.

Monitoring Recommendations

Forward router syslog data to a centralized logging or SIEM platform to retain admin actions and configuration import events.
Baseline normal egress traffic from the router itself and alert on deviations such as outbound shells, DNS tunneling, or connections to threat intelligence-flagged hosts.
Periodically audit administrator account inventories and credential rotation on all edge networking devices.

How to Mitigate CVE-2026-22229

Immediate Actions Required

Upgrade TP-Link Archer BE230 v1.2 to firmware 1.2.4 Build 20251218 rel.70420 or later, available from the TP-Link Archer BE230 download page.
Upgrade TP-Link Deco BE25 v1.0 to a firmware build released after 1.1.1 Build 20250822, available from the TP-Link Deco BE25 download page.
Rotate the administrator password and any other credentials stored or used on the router after patching.
Review existing VPN client configurations and remove any that are unrecognized.

Patch Information

TP-Link has released fixed firmware for both affected devices. Refer to the TP-Link FAQ #4935 advisory for the official guidance and download links. Confirm the build identifier shown in the router's web UI matches or exceeds the fixed versions listed above after applying the update.

Workarounds

Disable remote management of the router from the WAN side until the firmware update is applied.
Restrict administrative access to the LAN and require strong, unique credentials with multi-factor authentication where supported.
Avoid importing VPN client configuration files from untrusted sources; treat configuration files as executable content.
Segment management traffic on a dedicated VLAN to limit who can reach the router admin interface.

bash

# Configuration example - verify the running firmware build on TP-Link routers
# via the web UI: System Tools -> Firmware Upgrade -> Current Firmware Version
# Ensure the displayed build is at or above the fixed versions:
#   Archer BE230 v1.2: 1.2.4 Build 20251218 rel.70420
#   Deco BE25 v1.0:    post 1.1.1 Build 20250822