CVE-2026-9044

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware	Product
https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware	Product
https://www.tp-link.com/us/support/faq/5215/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección de comandos del sistema operativo existe en el módulo VPN de los routers TP-Link AXE75 V1. Esta vulnerabilidad permite a un atacante adyacente y autenticado ejecutar comandos arbitrarios en el dispositivo importando un archivo de configuración de cliente VPN especialmente diseñado. El problema surge de un filtrado inadecuado de caracteres especiales. La explotación exitosa de esta vulnerabilidad puede permitir a un atacante obtener control total del dispositivo afectado, comprometiendo potencialmente la integridad de la configuración, la seguridad de la red y la disponibilidad del servicio.

Information

Published : 2026-07-31 23:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-9044

Mitre link : CVE-2026-9044

CVE.ORG link : CVE-2026-9044

JSON object : View

Products Affected

tp-link

archer_axe75_firmware
archer_axe75

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-9044", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9044", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-03T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "modules": ["openvpn"], "product": "AXE75 V1", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.6 Build 20260623", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T23:17:26.767", "references": [{"url": "https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5215/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from\u00a0improper filtering of special characters.\u00a0\n\nSuccessful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo existe en el m\u00f3dulo VPN de los routers TP-Link AXE75 V1. Esta vulnerabilidad permite a un atacante adyacente y autenticado ejecutar comandos arbitrarios en el dispositivo importando un archivo de configuraci\u00f3n de cliente VPN especialmente dise\u00f1ado. El problema surge de un filtrado inadecuado de caracteres especiales.\n\nLa explotaci\u00f3n exitosa de esta vulnerabilidad puede permitir a un atacante obtener control total del dispositivo afectado, comprometiendo potencialmente la integridad de la configuraci\u00f3n, la seguridad de la red y la disponibilidad del servicio."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BBF67BC-57E9-44C7-A540-85BE48C330A7", "versionEndExcluding": "1.5.6"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EB55E594-03BC-425B-8CED-A7DC00A2DCBD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}