Log in / Sign up

Vulnerability details

CVE-2026-22229

TP-Link Systems Archer BE230TP-Link Systems Deco BE25

Command Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0

CVSS 4.0
8.6High

Official description

A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420 and Deco BE25 v1.0: through 1.1.1 Build 20250822.

CVSS scores

ScoreVersionSourceVector
8.6High 4.0 CVEProject cvelistV5 (CNA) (TPLink) CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Affected products

VendorProductVersionsSource
TP-Link Systems Inc. Archer BE230 v1.2 v < 1.2.4 Build 20251218 rel.70420 CVEProject cvelistV5 (CNA)
TP-Link Systems Inc. Deco BE25 v1.0 v ≤ 1.1.1 Build 20250822 CVEProject cvelistV5 (CNA)

References and advisories

7
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-02-02
Last updated
2026-03-02
State
Published
Assigner (CNA)
TPLink

Exploit prediction (EPSS)

2.09%
Probability of exploitation in 30 days
81.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-78
    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')