This vulnerability (CVE-2026-22226) is an OS command injection issue (CWE-78) in TP-Link Archer BE230 v1.2 and Archer AX73 v2 devices. It occurs in the VPN server configuration module and requires the attacker to be authenticated as an administrator. Successful exploitation allows execution of arbitrary OS commands with administrative privileges, leading to full device compromise. Multiple distinct OS command injection vulnerabilities exist in these devices, each tracked separately. The affected firmware versions are Archer BE230 v1.2 versions before 1.2.4 Build 20251218 rel.70420 and Archer AX73 v2 versions before 1.3.1 Build 20260430.

An attacker who has authenticated as an administrator can exploit this vulnerability to execute arbitrary OS commands on the affected device. This results in full administrative control, enabling compromise of device configuration, network security, and service availability. The severity is high due to the potential for complete device takeover and disruption of network operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description references fixed versions (Archer BE230 v1.2 >= 1.2.4 Build 20251218 rel.70420 and Archer AX73 v2 >= 1.3.1 Build 20260430), indicating that updating to these or later firmware versions should remediate the issue. Until official patches or updates are confirmed, restrict administrative access and monitor for suspicious activity. Verify with TP-Link's official advisories for the latest remediation instructions.