PT-2026-66875 · Tp Link Systems · Axe75 V1

Carlcamel · CVE-2026-9044 · Published 2026-07-31 · Updated 2026-07-31

NVD

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. 

Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-9044

Affected Products

Axe75 V1

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9044 · Security Note
• https://tp-link.com/us/support/faq/5215 · Vendor Advisory
• https://tp-link.com/us/support/download/archer-axe75/v1/#Firmware · Patch
• https://tp-link.com/en/support/download/archer-axe75/v1/#Firmware · Patch