Review reviewHigh

CVE-2026-0631

TP-Link Systems Inc. Archer BE230 v1.2, Archer AXE75 v1, archer be230 firmware

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and OpenVPN of AXE75 v1 allows an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID. This issue affects Archer BE230 v1.2 <...

CVSS: 8.5
EPSS: 1.36%
CISA KEV: Not listed
Published: 2026.02.03

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability1.36%

Technical severityCVSS 8.5

Vulnerability overview

Affected product and versions

Product: TP-Link Systems Inc. Archer BE230 v1.2, Archer AXE75 v1, archer be230 firmware
Affected versions: < 1.2.4 Build 20251218 rel.70420, < 1.5.6 Build 20260623, < 1.2.4
Fixed versions: 1.2.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that TP-Link Systems Inc. Archer BE230 v1.2, Archer AXE75 v1, archer be230 firmware and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE: CWE-78