{"id":"CVE-2026-22220","aliases":["EUVD-2026-5216","GHSA-gm7f-mr33-3p7w"],"status":"published","title":"Improper Input Validation Leading to DoS on TP-Link Archer BE230","description":"A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted.\nThis issue affects Archer BE230 v1.2 \u003c 1.2.4 Build 20251218 rel.70420.","severity":{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00246,"percentile":0.16054,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2026-02-03T17:15:59Z","modified":"2026-06-17T10:19:34Z","products":[{"vendor":"tp-link","product":"archer_be230_firmware"},{"vendor":"tp-link systems inc.","product":"archer be230 v1.2"}],"references":[{"url":"https://www.tp-link.com/us/support/download/archer-be230/v1.20/#Firmware","tags":["patch","Product"]},{"url":"https://www.tp-link.com/en/support/download/archer-be230/v1.20/#Firmware","tags":["patch","Product"]},{"url":"https://www.tp-link.com/sg/support/download/archer-be230/v1.20/#Firmware","tags":["patch","Product"]},{"url":"https://www.tp-link.com/us/support/faq/4941/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22220"},{"url":"https://www.tp-link.com/us/support/faq/4941"},{"url":"https://github.com/advisories/GHSA-gm7f-mr33-3p7w"}],"sources":{"cve":[{"id":"CVE-2026-22220","title":"Improper Input Validation Leading to DoS on TP-Link Archer BE230","description":"A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted.\nThis issue affects Archer BE230 v1.2 \u003c 1.2.4 Build 20251218 rel.70420.","status":"published","published":"2026-02-03T17:15:59.836Z","modified":"2026-02-04T18:32:13.84Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T13:39:05.585774Z"}],"euvd":[{"id":"EUVD-2026-5216","description":"A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted.\nThis issue affects Archer BE230 v1.2 \u003c 1.2.4 Build 20251218 rel.70420.","status":"published","published":"2026-02-03T17:15:59Z","modified":"2026-02-04T18:32:13Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:44.193176Z"}],"ghsa":[{"id":"GHSA-gm7f-mr33-3p7w","title":"A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web...","description":"A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted.\nThis issue affects Archer BE230 v1.2 \u003c 1.2.4 Build 20251218 rel.70420.","status":"published","published":"2026-02-03T18:30:47Z","modified":"2026-02-13T21:31:33Z","cvss":[{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:06:12.455729Z"}],"nvd":[{"id":"CVE-2026-22220","description":"A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a crafted request to cause the device’s web service to become unresponsive, resulting in a denial of service condition. A network adjacent attacker with high privileges could cause the device’s web interface to temporarily stop responding until it recovers or is rebooted.\nThis issue affects Archer BE230 v1.2 \u003c 1.2.4 Build 20251218 rel.70420.","status":"published","published":"2026-02-03T18:16:19.077Z","modified":"2026-06-17T10:19:34.56Z","cvss":[{"version":"4.0","score":6.8,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:12:05.149641Z"}]}}