Loading vulnerability…
Authenticated OS Command Injection in TP-Link Archer BE230 and AXE75 Web Modules
CVE-2026-22222 is an OS command injection vulnerability in the web modules of TP-Link Archer BE230 v1.2 and Archer AXE75 v2 routers. An authenticated attacker on an adjacent network can execute arbitrary operating system commands, potentially gaining full administrative control of the device. Archer BE230 v1.2 firmware earlier than 1.2.4 Build 20251218 rel.70420 is affected. The specific vulnerable function and affected AXE75 v2 firmware range are not available. This vulnerability is distinct from other command injection issues tracked separately in the same product family.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the router's confidentiality, integrity, and availability through arbitrary command execution and full administrative takeover. An attacker could alter device configuration, undermine network security, access sensitive information, and disrupt router services.
If you can’t patch tonight, do this now.
Restrict access to the web administration interface to trusted administrators and isolate management access from untrusted adjacent-network users. Use strong, unique administrator credentials and disable remote management when unnecessary. These measures reduce exposure but do not replace the firmware update; no vulnerability-specific workaround is identified.
Patch, then assume compromise.
Upgrade Archer BE230 v1.2 to firmware 1.2.4 Build 20251218 rel.70420 or a later vendor-supported release appropriate for the device's hardware revision and region. For Archer AXE75 v2, apply the latest security firmware identified by TP-Link for CVE-2026-22222; a specific fixed firmware version is not available in the supplied information.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.