TP-Link Patches Command Injection Flaws in Archer AX73 and BE230 Routers
Vulnerability Disclosure · 2 sources · Updated 11d ago · First seen Oct 15, 2026
TP-Link released firmware fixes for two authenticated OS command injection vulnerabilities that can give attackers full administrative control of affected Archer routers. CVE-2026-22226 affects the VPN server configuration module in the Archer AX73 v2 and Archer BE230 v1.2, while CVE-2026-22222 affects web modules in the Archer BE230 v1.2. Both require local-network access and administrator credentials, need no additional user interaction, and carry a TP-Link CVSS 4.0 severity score of 8.5 (High).
An anonymous FuzzingLabs researcher discovered the vulnerabilities, with fixes released through coordinated disclosure. TP-Link’s related advisory covers a broader set of authenticated command injection flaws affecting Archer BE230, Archer AXE75, and Deco BE25 devices; the affected models differ by vulnerability. Administrators should verify each device’s model and hardware revision against the vendor advisory and install the corresponding fixed firmware, prioritizing routers whose management interfaces are accessible to untrusted local-network users.
