FKIE_CVE-2026-0631

Vulnerability from fkie_nvd - Published: 2026-02-02 18:16 - Updated: 2026-02-06 18:36
Severity ?
8.0 (High) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
References
f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/archer-be230/v1.20/#FirmwareProduct
f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/sg/support/download/archer-be230/v1.20/#FirmwareProduct
f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/archer-be230/v1.20/#FirmwareProduct
f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/4935/Vendor Advisory, Patch
Impacted products
Vendor Product Version
tp-link archer_be230_firmware *
tp-link archer_be230 1.20
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:tp-link:archer_be230_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5BA03F6-BE09-4124-9B70-32BE881EDB09",
              "versionEndExcluding": "1.2.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:tp-link:archer_be230:1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "2619D728-00BA-47E8-AC08-F682A7E82578",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent \n\nauthenticated \n\nattacker to\u00a0execute arbitrary code.\u00a0Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability.\n\nThis CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 \u003c 1.2.4 Build 20251218 rel.70420."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo (OS) en TP-Link Archer BE230 v1.2 (m\u00f3dulos vpn) permite a un atacante autenticado adyacente ejecutar c\u00f3digo arbitrario. La explotaci\u00f3n exitosa podr\u00eda permitir a un atacante obtener control administrativo total del dispositivo, lo que resultar\u00eda en un compromiso grave de la integridad de la configuraci\u00f3n, la seguridad de la red y la disponibilidad del servicio.\n\nEste CVE cubre uno de m\u00faltiples problemas distintos de inyecci\u00f3n de comandos del sistema operativo (OS) identificados en rutas de c\u00f3digo separadas. Aunque de naturaleza similar, cada instancia se rastrea bajo una ID de CVE \u00fanica. Este problema afecta a Archer BE230 v1.2 \u0026lt; 1.2.4 Build 20251218 rel.70420."
    }
  ],
  "id": "CVE-2026-0631",
  "lastModified": "2026-02-06T18:36:44.913",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "HIGH",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-02-02T18:16:13.620",
  "references": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product"
      ],
      "url": "https://www.tp-link.com/en/support/download/archer-be230/v1.20/#Firmware"
    },
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product"
      ],
      "url": "https://www.tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware"
    },
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product"
      ],
      "url": "https://www.tp-link.com/us/support/download/archer-be230/v1.20/#Firmware"
    },
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Vendor Advisory",
        "Patch"
      ],
      "url": "https://www.tp-link.com/us/support/faq/4935/"
    }
  ],
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.