How severe is CVE-2026-22228?

CVE-2026-22228 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-22228 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-22228?

CVE-2026-22228 affects Tp-link Archer Be230 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-22228?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-22228 have an EU (EUVD) identifier?

Yes. CVE-2026-22228 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5214.

When was CVE-2026-22228 published?

CVE-2026-22228 was published on 2026-02-03 and last updated on 2026-06-17.

CVE-2026-22228

CVE-2026-22228 is a medium-severity vulnerability in Tp-link Archer Be230 Firmware with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 4.9)
CVSS v4: 6.8
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-5214
Weakness: CWE-400
Affected product: Tp-link Archer Be230 Firmware
Published: 2026-02-03
Last modified: 2026-06-17

Description

An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file containing an excessively long parameter. Restoring such a file can cause the device to become unresponsive, requiring a reboot to restore normal operation. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

Frequently asked questions

What is CVE-2026-22228?: An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by restoring a crafted configuration file containing an excessively long parameter. Restoring such a file can cause the device to become unresponsive, requiring a reboot to restore normal operation. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
How severe is CVE-2026-22228?: CVE-2026-22228 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-22228 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-22228?: CVE-2026-22228 affects Tp-link Archer Be230 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-22228?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-22228 have an EU (EUVD) identifier?: Yes. CVE-2026-22228 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5214.
When was CVE-2026-22228 published?: CVE-2026-22228 was published on 2026-02-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:tp-link:archer_be230_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Tp-link Archer Be230 Firmware

CVE-2026-22223 — High (CVSS 8.0): An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated…
CVE-2026-22222 — High (CVSS 8.0): An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) allows adjacent authenticated…
CVE-2026-22221 — High (CVSS 8.0): An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows adjacent authenticated…
CVE-2026-0631 — High (CVSS 8.0): An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent authenticated…
CVE-2026-0630 — High (CVSS 8.0): An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent…
CVE-2026-22229 — High (CVSS 7.2): A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN…

All CVEs affecting Tp-link Archer Be230 Firmware →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →