CVE-2026-22223 TP‑Link CVE debrief

Who should care

Network administrators and security teams responsible for TP-Link Archer BE230 v1.2 and BE3600 v1 devices should assess exposure and prioritize patching or mitigation efforts to prevent potential compromise of network security and configuration integrity.

Why it matters

CVE-2026-22223 is an OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 that could allow an attacker to gain full administrative control of the device. Defenders should prioritize verifying exposure, assessing network security, and applying patches or mitigations as available.

• Potential compromise of configuration integrity
• Potential impact on network security
• Potential disruption of service availability
• Verification of device exposure and patch status

Technical summary

The vulnerability is an OS Command Injection issue in the vpn modules of TP-Link Archer BE230 v1.2 and BE3600 v1. An adjacent authenticated attacker could exploit this vulnerability to execute arbitrary code, potentially gaining full administrative control of the device. This could result in severe compromise of configuration integrity, network security, and service availability. The issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420. Defenders should prioritize verifying exposure of TP-Link Archer BE230 v1.2 and BE3600 v1 devices, assessing network security and configuration integrity, and applying patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying exposure of TP-Link Archer BE230 v1.2 and BE3600 v1 devices, assessing network security and configuration integrity, and applying patches or mitigations as available.

Recommended defensive actions

• Verify exposure of TP-Link Archer BE230 v1.2 and BE3600 v1 devices in the network
• Assess network security and configuration integrity
• Apply patches or mitigations as available
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail provide information on the OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1. The vendor provides firmware download links for affected products.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.