Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-9151

An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters.  Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially co
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:6674e4d94bbb821c0b2bd21aec2ac4b82f1532dde915a23a6d84557d85bb5307
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 4 assertions

{"defaultStatus":"unaffected","product":"Archer AX17 v1","vendor":"TP Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/2

{"defaultStatus":"unaffected","modules":["openvpn"],"product":"Archer AX12 V1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Archer AX18 v1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Archer AX1300 v1.6","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/3

Affected products and versions

4 source assertions
{"defaultStatus":"unaffected","product":"Archer AX17 v1","vendor":"TP Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/2
{"defaultStatus":"unaffected","modules":["openvpn"],"product":"Archer AX12 V1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Archer AX18 v1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Archer AX1300 v1.6","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"V1_1.5.0 Build 20260605","status":"affected","version":"0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/affected/3

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"ADJACENT","baseScore":8.5,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HI…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-78","description":"CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/problemTypes/0/descriptions/0

Source references

5 source assertions
{"tags":["patch"],"url":"https://www.tp-link.com/en/support/download/archer-ax12/#Firmware"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/references/1
{"tags":["patch"],"url":"https://www.tp-link.com/en/support/download/archer-ax17/#Firmware"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/references/0
{"tags":["patch"],"url":"https://www.tp-link.com/en/support/download/archer-ax18/#Firmware"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/references/2
{"tags":["patch"],"url":"https://www.tp-link.com/us/support/download/archer-ax1300/#Firmware"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/references/3
{"tags":["vendor-advisory"],"url":"https://www.tp-link.com/us/support/faq/5125/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0b124ad0b2f139c4f2c0be23d64e45cde392feadbd9fedc8c8b7e25893ab85ea · sha256:c2367e7ed305116d… · /containers/cna/references/4

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer