CVE-2026-22220

MEDIUM

TP-Link Archer BE230 < 1.2.4 - Denial of Service via HTTP Request

Title source: llm
STIX 2.1

Description

A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted. This issue affects Archer BE230 v1.2 < 1.2.4 Build 20251218 rel.70420.

References (4)

Core 4

Scores

CVSS v3 4.5
EPSS 0.0022
EPSS Percentile 12.0%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (1)
tp-link/archer_be230_firmware < 1.2.4
Published Feb 03, 2026
Tracked Since Feb 18, 2026