An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent authenticated attacker to execute arbitrary code. (CVE-2026-0631)
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
AI Analysis
Technical Summary
CVE-2026-0631 describes an OS Command Injection vulnerability in the VPN modules of TP-Link Archer BE230 version 1.2. An attacker with adjacent network access and authentication privileges can exploit this vulnerability to execute arbitrary commands on the device. Successful exploitation grants full administrative control, compromising device configuration, network security, and availability. This CVE is one of several distinct OS command injection issues in the product. The affected versions are all releases before 1.2.4 Build 20251218 rel.70420. No vendor advisory or patch information is currently available.
Potential Impact
An adjacent authenticated attacker can execute arbitrary OS commands on the affected device, leading to full administrative control. This results in a severe compromise of device configuration integrity, network security, and service availability. The CVSS v3.1 base score is 8.0 (High), reflecting the critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interfaces to trusted users only and monitor for suspicious activity. Avoid exposing the device to untrusted adjacent networks where possible.
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent authenticated attacker to execute arbitrary code. (CVE-2026-0631)
Description
An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) allows an adjacent authenticated attacker to execute arbitrary code. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise of configuration integrity, network security, and service availability. This CVE covers one of multiple distinct OS command injection issues identified across separate code paths. Although similar in nature, each instance is tracked under a unique CVE ID.This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.
CVSS v3.1
Score 8.0high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-0631 describes an OS Command Injection vulnerability in the VPN modules of TP-Link Archer BE230 version 1.2. An attacker with adjacent network access and authentication privileges can exploit this vulnerability to execute arbitrary commands on the device. Successful exploitation grants full administrative control, compromising device configuration, network security, and availability. This CVE is one of several distinct OS command injection issues in the product. The affected versions are all releases before 1.2.4 Build 20251218 rel.70420. No vendor advisory or patch information is currently available.
Potential Impact
An adjacent authenticated attacker can execute arbitrary OS commands on the affected device, leading to full administrative control. This results in a severe compromise of device configuration integrity, network security, and service availability. The CVSS v3.1 base score is 8.0 (High), reflecting the critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interfaces to trusted users only and monitor for suspicious activity. Avoid exposing the device to untrusted adjacent networks where possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-j6g9-f586-p93v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-0631"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6daad3bf32cb7a3466777d
Added to database: 08/01/2026, 08:14:11 UTC
Last enriched: 08/01/2026, 08:18:09 UTC
Last updated: 09/15/2026, 10:01:30 UTC
Views: 48
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.