CVE-2026-9044
Full vulnerability record from the local CVENow database.
Description
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.
Severity
HIGH
CVSS score
8.5
(v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-07-31 23:17:26.767000
Last modified
2026-10-23 23:10:00.157000
View original CVE JSON
{
"id": "CVE-2026-9044",
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"published": "2026-07-31T23:17:26.767",
"lastModified": "2026-10-23T23:10:00.157",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. \n\nSuccessful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyección de comandos del sistema operativo existe en el módulo VPN de los routers TP-Link AXE75 V1. Esta vulnerabilidad permite a un atacante adyacente y autenticado ejecutar comandos arbitrarios en el dispositivo importando un archivo de configuración de cliente VPN especialmente diseñado. El problema surge de un filtrado inadecuado de caracteres especiales.\n\nLa explotación exitosa de esta vulnerabilidad puede permitir a un atacante obtener control total del dispositivo afectado, comprometiendo potencialmente la integridad de la configuración, la seguridad de la red y la disponibilidad del servicio."
}
],
"affected": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"affectedData": [
{
"vendor": "TP-Link Systems Inc.",
"product": "AXE75 V1",
"defaultStatus": "unaffected",
"modules": [
"openvpn"
],
"versions": [
{
"version": "0",
"lessThan": "1.5.6 Build 20260623",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-03T00:00:00+00:00",
"id": "CVE-2026-9044",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.6",
"matchCriteriaId": "6BBF67BC-57E9-44C7-A540-85BE48C330A7"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EB55E594-03BC-425B-8CED-A7DC00A2DCBD"
}
]
}
]
}
],
"references": [
{
"url": "https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
]
},
{
"url": "https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Product"
]
},
{
"url": "https://www.tp-link.com/us/support/faq/5215/",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
]
}
]
}