CVE-2026-9151
Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.
| CWE | CWE-78 |
| Vendor | tp-link systems inc. |
| Product | archer ax12 v1 |
| Published | Jun 10, 2026 |
| Last Updated | Jun 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for tp-link systems inc. archer ax12 v1
Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. archer ax12 v1 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TP-Link Systems Inc. / Archer AX12 V1
0 < V1_1.5.0 Build 20260605
TP-Link Systems Inc. / Archer AX18 v1
0 < V1_1.5.0 Build 20260605
TP Link Systems Inc. / Archer AX17 v1
0 < V1_1.5.0 Build 20260605
TP-Link Systems Inc. / Archer AX1300 v1.6
0 < V1_1.5.0 Build 20260605
References
tp-link.com: https://www.tp-link.com/en/support/download/archer-ax17/#Firmware tp-link.com: https://www.tp-link.com/en/support/download/archer-ax12/#Firmware tp-link.com: https://www.tp-link.com/en/support/download/archer-ax18/#Firmware tp-link.com: https://www.tp-link.com/us/support/download/archer-ax1300/#Firmware tp-link.com: https://www.tp-link.com/us/support/faq/5125/
Credits
Henri Nurmi