Improper input validation in Tp-Link Archer Be230
CVE-2026-22220
A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.002 (12.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Tp-link Archer_be230 — versions 1.20
- Tp-link Archer_be230_firmware
- Tp-link Systems Inc. Archer Be230 V1.2 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-22220?
- CVE-2026-22220 is a medium-severity vulnerability in Tp-Link Archer Be230, classified under Improper Input Validation. CVSS score: 4.5/10. Published 2026-02-03.
- How severe is CVE-2026-22220?
- Medium severity. CVSS v3 base score is 4.5 out of 10.