PT-2026-48516 · Tp Link Systems · Archer Ax12 V1+3

Henri Nurmi · Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-9151

NVD

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters. 

Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-9151

Affected Products

Archer Ax12 V1

Archer Ax1300 V1.6

Archer Ax17 V1

Archer Ax18 V1

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-9151 · Security Note
• https://tp-link.com/en/support/download/archer-ax18/#Firmware · Patch
• https://tp-link.com/us/support/faq/5125 · Vendor Advisory
• https://tp-link.com/en/support/download/archer-ax12/#Firmware · Patch
• https://tp-link.com/en/support/download/archer-ax17/#Firmware · Patch
• https://tp-link.com/us/support/download/archer-ax1300/#Firmware · Patch