Priority MEDIUM 43
A command injection vulnerability may be exploited after the admin's authentication via the import of a crafted VPN client configuration file on the TP-Link Archer BE230 v1.2 and Deco BE25 v1.0.
CVSS 4.0HIGH 8.6· Network · High privileges · No interaction · EPSS 0.02093 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420 CWE-78
Priority MEDIUM 44
A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.02659 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420 CWE-78
Priority MEDIUM 44
A command injection vulnerability may be exploited after the admin's authentication in the VPN server configuration module on TP-Link Archer BE230 v1.2 and Archer AX73 v2.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.02465 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, 1.3.1 Build 20260430 CWE-78
Priority MEDIUM 44
A command injection vulnerability may be exploited after the admin's authentication in the VPN Connection Service on the Archer BE230 v1.2 and Archer AXE75 v1.0.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.02738 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, < 1.5.3 Build 20260209 rel. 71108 CWE-78
Priority MEDIUM 44
A command injection vulnerability may be exploited after the admin's authentication in the cloud communication interface on the TP-Link Archer BE230 v1.2.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.02651 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420 CWE-78
Priority MEDIUM 42
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authenticated attacker execute arbitrary code.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.01376 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, (KR)_V1_1.2.2 Build 20260903 +2 CWE-78
Priority MEDIUM 42
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent authenticated attacker to execute arbitrary code.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.0155 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, V2_1.2.0 Build 20260603 CWE-78
Priority MEDIUM 42
An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE3600v1, AX10 v3 and AXE75 v1, allowing an adjacent authenticated attacker to execute arbitrary code.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.01623 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, 1.5.6 Build 20260623 +4 CWE-78
Priority MEDIUM 42
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent authenticated attacker to execute arbitrary code.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.01338 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, 1.5.3 Build 20260209 rel. 71108 CWE-78
Priority MEDIUM 42
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenticated attacker execute arbitrary code.
CVSS 4.0HIGH 8.5· Adjacent network · High privileges · No interaction · EPSS 0.01409 · Published 2026-02-02 · Fixed in 1.2.4 Build 20251218 rel.70420, (KR)_V1_1.2.2 Build 20260903 +2 CWE-78
THREATIST.IORead the docs