# CVE-2026-22221: TP-Link Archer BE230 and BE3600 OS command injection

Source: https://junglewise.ai/threats/cve-2026-22221-tp-link-archer-be230-and-be3600-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-22221 · Severity: high · CVSS 8 · Published 2026-02-02

TP-Link Archer wireless routers (BE230 and BE3600 models) contain an OS command injection vulnerability in VPN-related code that allows an authenticated user on the network to execute arbitrary commands with administrative privileges. An attacker exploiting this flaw could take complete control of the router, compromise network security settings, intercept or redirect user traffic, and disrupt internet service for all devices connected to it.

Technologies: [TP-Link Archer BE3600](https://junglewise.ai/threats/technologies/archer-be3600), [TP-Link Archer Be230](https://junglewise.ai/threats/technologies/archer-be230), [TP-Link Archer Be230 Firmware](https://junglewise.ai/threats/technologies/archer-be230-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-22221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22221 being exploited in the wild.

**How severe is CVE-2026-22221?** High severity, with a CVSS score of 8, published 2 February 2026.

**Which products and versions are affected?** TP-Link Archer BE3600 v1; TP-Link Archer Be230 v1.2 < 1.2.4 Build 20251218 rel.70420.

**Is there a fix for CVE-2026-22221?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-22221 attacked?** It is attacked over the network or from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-22221?** Check whether you run TP-Link Archer BE3600, TP-Link Archer Be230 or TP-Link Archer Be230 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the VPN module code path of TP-Link Archer BE230 v1.2 and BE3600 v1 routers, allowing authenticated adjacent network attackers to inject and execute arbitrary operating system commands. The vulnerability requires network proximity and prior authentication but not necessarily administrative credentials. Successful exploitation grants full administrative control of the device, enabling attackers to modify router configuration, install malicious code, and compromise network operations. A patch is available for Archer BE230 (version 1.2.4 Build 20251218 rel.70420 or later); patch status for BE3600 should be verified with TP-Link.

## Affected products

- TP-Link Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420
- TP-Link Archer BE3600 v1

## Timeline

- 2026-02-02: disclosed
- 2026: other: Patch available for Archer BE230 version 1.2.4 Build 20251218 rel.70420

## References

- [https://www.tp-link.com/en/support/download/archer-be230/v1.20/](https://www.tp-link.com/en/support/download/archer-be230/v1.20/)
- [https://www.tp-link.com/en/support/download/archer-be3600/v1/](https://www.tp-link.com/en/support/download/archer-be3600/v1/)

## Related threats

- [TP-Link Archer BE3600 stored OS command injection in parental control](https://junglewise.ai/threats/cve-2026-78541-tp-link-archer-be3600-stored-os-command-injection-in-parental)
- [TP-Link Archer OS command injection in parental control](https://junglewise.ai/threats/cve-2026-9254-tp-link-archer-os-command-injection-in-parental-control)
- [TP-Link Archer command injection in VPN server configuration](https://junglewise.ai/threats/cve-2026-22226-tp-link-archer-command-injection-in-vpn-server-configuration)
- [TP-Link Archer BE230 and BE3600 OS command injection in VPN module](https://junglewise.ai/threats/cve-2026-22223-tp-link-archer-be230-and-be3600-os-command-injection-in-vpn)
- [An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent…](https://junglewise.ai/threats/cve-2026-22222-an-os-command-injection-vulnerability-in-tp-link-archer-be230-v1)