# CVE-2026-0631: TP-Link Archer Routers OS command injection in VPN modules

Source: https://junglewise.ai/threats/cve-2026-0631-tp-link-archer-routers-os-command-injection-in-vpn-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-0631 · Severity: high · CVSS 8 · Published 2026-02-02

A security vulnerability exists in the VPN modules of certain TP-Link Archer routers, which are devices used to manage home and small office internet connections. An attacker who is already connected to the local network could exploit this flaw to take full administrative control of the router. This could allow them to monitor network traffic, change security settings, or disable internet access entirely.

Technologies: [TP-Link Archer Be230](https://junglewise.ai/threats/technologies/archer-be230), [TP-Link Archer Be230 Firmware](https://junglewise.ai/threats/technologies/archer-be230-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-0631 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0631 being exploited in the wild.

**How severe is CVE-2026-0631?** High severity, with a CVSS score of 8, published 2 February 2026.

**Which products and versions are affected?** TP-Link Archer AXE75 < 1.5.6 Build 20260623; TP-Link Archer Be230 < 1.2.4 Build 20251218 rel.70420.

**Is there a fix for CVE-2026-0631?** A patch was published on 2025-12-18: Patch released for Archer BE230 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-0631 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-0631?** Check whether you run TP-Link Archer AXE75, TP-Link Archer Be230 or TP-Link Archer Be230 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists within the VPN modules of the TP-Link Archer BE230 v1.2 and the OpenVPN component of the Archer AXE75 v1. The flaw is caused by improper neutralization of special elements used in OS commands (CWE-78) across specific code paths. An adjacent attacker with low-level authentication can exploit this to execute arbitrary system commands. Successful exploitation grants the attacker full administrative access to the device, compromising configuration integrity and service availability. Patches are available in firmware versions 1.2.4 Build 20251218 (BE230) and 1.5.6 Build 20260623 (AXE75).

## Affected products

- TP-Link Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420
- TP-Link Archer AXE75 v1 < 1.5.6 Build 20260623

## Timeline

- 2026-02-02: advisory: Initial NVD publication date
- 2025-12-18: patched: Patch released for Archer BE230
- 2026-06-23: patched: Patch released for Archer AXE75

## References

- [https://www.tp-link.com/en/support/download/archer-axe75/v1/](https://www.tp-link.com/en/support/download/archer-axe75/v1/)
- [https://www.tp-link.com/en/support/download/archer-be230/v1.20/](https://www.tp-link.com/en/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/sg/support/download/archer-be230/v1.20/](https://www.tp-link.com/sg/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/us/support/download/archer-axe75/v1/](https://www.tp-link.com/us/support/download/archer-axe75/v1/)
- [https://www.tp-link.com/us/support/download/archer-be230/v1.20/](https://www.tp-link.com/us/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/us/support/faq/4935/](https://www.tp-link.com/us/support/faq/4935/)

## Related threats

- [TP-Link Archer AXE75 OS command injection in VPN module](https://junglewise.ai/threats/cve-2026-9044-tp-link-archer-axe75-os-command-injection-in-vpn-module)
- [TP-Link Archer command injection in VPN server configuration](https://junglewise.ai/threats/cve-2026-22226-tp-link-archer-command-injection-in-vpn-server-configuration)
- [TP-Link Archer BE230 and BE3600 OS command injection in VPN module](https://junglewise.ai/threats/cve-2026-22223-tp-link-archer-be230-and-be3600-os-command-injection-in-vpn)
- [An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent…](https://junglewise.ai/threats/cve-2026-22222-an-os-command-injection-vulnerability-in-tp-link-archer-be230-v1)
- [TP-Link Archer BE230 and BE3600 OS command injection](https://junglewise.ai/threats/cve-2026-22221-tp-link-archer-be230-and-be3600-os-command-injection)