Security readout for executives and security teams
Plain-English summary
CVE-2026-22229 is a high-severity command injection issue in TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 devices. An attacker who already has administrator authentication could import a crafted VPN client configuration file and potentially gain full administrative control of the router or mesh device.
Executive priority
Prioritize remediation for any affected device that manages sensitive networks, has remote administration enabled, or uses shared/weak administrator credentials. Treat as high priority because compromise after admin authentication could give full device control.
Technical view
The vulnerability is CWE-78 OS command injection in the VPN client configuration import path. The CVE states exploitation requires network access and high privileges, with no user interaction. Affected versions are Archer BE230 v1.2 before 1.2.4 Build 20251218 rel.70420 and Deco BE25 v1.0 through 1.1.1 Build 20250822. CVSS v4.0 score is 8.6 High with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L.
Likely exposure
Exposure is limited to TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 devices running the affected firmware, especially where administrative access is reachable over the network or administrator credentials may be compromised. The issue is post-authentication, so unauthenticated internet scanning alone is not enough based on the supplied sources.
Exploitation context
The supplied bundle does not indicate known active exploitation, and kev is false. Exploitation requires authenticated administrator access and import of a crafted VPN client configuration file. Successful exploitation could compromise device configuration integrity, network security, and service availability.
Researcher notes
This CVE is one of multiple distinct OS command injection issues across separate code paths. Do not merge its scope with other TP-Link CVEs unless a source explicitly links them. No exploit availability or active exploitation is supported by the supplied bundle.
Mitigation direction
- Upgrade Archer BE230 v1.2 devices to 1.2.4 Build 20251218 rel.70420 or later using official TP-Link firmware sources.
- For Deco BE25 v1.0, check TP-Link's official advisory and firmware download pages and upgrade beyond the affected range, since the bundle identifies versions through 1.1.1 Build 20250822 as affected but does not provide an exact fixed Deco version.
- Restrict administrative management access to trusted local networks only and avoid exposing device administration interfaces to untrusted networks.
- Review administrator accounts and credentials; rotate credentials if unauthorized access is suspected.
- Avoid importing VPN client configuration files from untrusted sources.
Validation and detection
- Inventory TP-Link Archer BE230 v1.2 and Deco BE25 v1.0 devices in the environment.
- Record current firmware versions and compare them against the affected ranges in the CVE.
- Confirm Archer BE230 v1.2 devices are running 1.2.4 Build 20251218 rel.70420 or later.
- For Deco BE25 v1.0, verify the installed firmware against TP-Link's current official advisory/download guidance rather than assuming a fixed version not present in the bundle.
- Confirm device administration is not reachable from untrusted networks and that only authorized administrators can access it.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-22229 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.6HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source materials
- CVE List V5 sourceCVE List V5
- https://www.tp-link.com/us/support/download/archer-be230/v1.20/#FirmwareCVE reference · patch
- https://www.tp-link.com/en/support/download/archer-be230/v1.20/#FirmwareCVE reference · patch
- https://www.tp-link.com/sg/support/download/archer-be230/v1.20/#FirmwareCVE reference · patch
- https://www.tp-link.com/us/support/faq/4935/CVE reference · vendor-advisory
- https://www.tp-link.com/sg/support/download/deco-be25/#FirmwareCVE reference · patch
- https://www.tp-link.com/en/support/download/deco-be25/#FirmwareCVE reference · patch
- https://www.tp-link.com/us/support/download/deco-be25/v1/#FirmwareCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.