CVE•Published 2026-02-02•Modified 2026-10-14•1 article on news•5 live references•NVD data

CVE-2026-22222Tp-link · Archer_be230_firmware

Vulnerability data via NVD (ingested)

CVSS v3.1

8.0

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 27% of all CVEs

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Description

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.

Timeline

Published 2026-02-02

Modified 2026-10-14

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-22222

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · OS

os:"Archer Be230 Firmware"

Hosts Shodan identified as running Archer Be230 Firmware.

More intel sources (5)

Shodan report

vuln:CVE-2026-22222

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-22222