TP-Link Archer AX1300 v1.6 up to 1.6 VPN Module os command injection

Summaryinfo

A vulnerability was found in TP-Link Archer AX12 V1, Archer AX18 v1, Archer AX17 v1 and Archer AX1300 v1.6 up to 1.6. It has been declared as critical. Affected by this issue is some unknown functionality of the component VPN Module. Such manipulation leads to os command injection. This vulnerability is referenced as CVE-2026-9151. The attack needs to be initiated within the local network. No exploit is available.

Detailsinfo

A vulnerability was found in TP-Link Archer AX12 V1, Archer AX18 v1, Archer AX17 v1 and Archer AX1300 v1.6 up to 1.6. It has been rated as critical. Affected by this issue is some unknown processing of the component VPN Module. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters.  Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

The weakness was published by Henri Nurmi. The advisory is available at tp-link.com. This vulnerability is handled as CVE-2026-9151 since 05/21/2026. The exploitation is known to be easy. Access to the local network is required for this attack to succeed. The exploitation requires an enhanced level of successful authentication. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/10/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• TP-Link

Name

• Archer AX12 V1
• Archer AX17 v1
• Archer AX18 v1
• Archer AX1300 v1.6

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion