TP-Link Archer BE230 Firmware vulnerabilities

12 CVEs affecting TP-Link Archer BE230 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-22228, published 2026-02-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-22225, published 2026-02-02. High severity, CVSS 7.2. EPSS: 2.8% chance of exploitation in the next 30 days. A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 and Archer AXE75 v1.0. Successful exploitation could allow…
CVE-2026-22227, published 2026-02-02. High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days. A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2. Successful exploitation could…
CVE-2026-22224, published 2026-02-02. High severity, CVSS 7.2. EPSS: 2.7% chance of exploitation in the next 30 days. A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2. Successful exploitation could allow an…
CVE-2026-22226, published 2026-02-02. High severity, CVSS 7.2. EPSS: 2.5% chance of exploitation in the next 30 days. A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2. Successful exploitation…
CVE-2026-22229, published 2026-02-02. High severity, CVSS 7.2. EPSS: 2.1% chance of exploitation in the next 30 days. A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0.…
CVE-2026-0631, published 2026-02-02. High severity, CVSS 8.0. EPSS: 1.6% chance of exploitation in the next 30 days. An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1 and AXE75 v1, allowing an adjacent authenticated attacker to execute…
CVE-2026-22222, published 2026-02-02. High severity, CVSS 8.0. EPSS: 1.6% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation…
CVE-2026-22221, published 2026-02-02. High severity, CVSS 8.0. EPSS: 1.4% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow…
CVE-2026-22223, published 2026-02-02. High severity, CVSS 8.0. EPSS: 1.4% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code. Successful exploitation could allow…
CVE-2026-0630, published 2026-02-02. High severity, CVSS 8.0. EPSS: 1.4% chance of exploitation in the next 30 days. An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arbitrary code. Successful exploitation…

Latest

CVE-2026-22228, published 2026-02-03. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file containing an excessively long parameter.…
CVE-2026-22220, published 2026-02-03. Medium severity, CVSS 4.5. EPSS: 0.2% chance of exploitation in the next 30 days. A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive,…