PT-2026-66875 · Tp Link Systems · Axe75 V1

Carlcamel · CVE-2026-9044 · Publicado 2026-07-31 · Atualizado 2026-07-31

NVD

CVSS v4.0

8.5

Alta

Vetor base

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. 

Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2026-9044

Produtos afetados

Axe75 V1

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9044 · Nota de Segurança
• https://tp-link.com/us/support/faq/5215 · Aviso do Fabricante
• https://tp-link.com/us/support/download/archer-axe75/v1/#Firmware · Correção
• https://tp-link.com/en/support/download/archer-axe75/v1/#Firmware · Correção