Vulnerability Description
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Archer Axe75 Firmware | < 1.5.6 |
| Tp-Link | Archer Axe75 | 1.0 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/archer-axe75/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/download/archer-axe75/v1/#FirmwareProduct
- https://www.tp-link.com/us/support/faq/5215/Vendor Advisory
FAQ
What is CVE-2026-9044?
CVE-2026-9044 is a vulnerability with a CVSS score of 8.0 (HIGH). An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by...
How severe is CVE-2026-9044?
CVE-2026-9044 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-9044?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Archer Axe75 Firmware, Tp-Link Archer Axe75.