PT-2026-5683

CVE-2026-0630

Published

2026-02-02

Updated

2026-02-03

Description by

CVSS 4.0

8.5

High

MetricsAV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420

Description An OS Command Injection issue exists in TP-Link Archer BE230 web modules. A nearby authenticated attacker can execute arbitrary code. Successful exploitation could grant an attacker full administrative control of the device, compromising configuration integrity, network security, and service availability. This is one of several distinct OS command injection issues identified in separate code paths.

Recommendations Update to version 1.2.4 Build 20251218 rel.70420 or later.

Exploitability

Fix

Impacts

Researchers

Charbel Farhat

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

Related identifiers

CVE-2026-0630