Read the docs
TI-2026-07948 Aliases CVE-2026-9044GHSA-4v8f-3c7h-9xrw

Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

Priority MEDIUM 44CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters.  Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02509 84th percentileScored 2026-11-07
Fix Fixed AXE75 V1 (TP-Link Systems Inc.): 1.5.6 Build 20260623

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkAXE75 V1before 1.5.6 Build 202606231.5.6 Build 20260623Patch availableCNA
  • AXE75 V1 VendorTP-Link Affected before 1.5.6 Build 20260623 Fixed in 1.5.6 Build 20260623 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:*before 1.5.6VulnerableTP-Link
cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
  • cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:* Versions before 1.5.6 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link

Remediation

  • Fix · CNA AXE75 V1 (TP-Link Systems Inc.) Fixed in 1.5.6 Build 20260623

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9044
  2. 2026-10-03 Alias added: GHSA-4v8f-3c7h-9xrw

References

Patch 2

Advisory 1

  • TI-2024-14497 OS command injection in TP-Link Archer AX3000 CVSS 3.1HIGH 8.0
  • TI-2025-14207 Command Injection Vulnerability on TP-Link Archer AXE75 CVSS 4.0HIGH 8.5
  • TI-2024-14508 OS command injection in TP-Link Archer AX3000 CVSS 3.1HIGH 8.8
  • TI-2025-13718 Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75 CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences