CVE-2026-9044

Katalog CVE

CVSS 8.0 · High EPSS 2,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada tp-link archer axe75 firmware. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters.  Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Rincian

Terbit di NVD

31 Juli 2026

Terakhir diubah

7 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,5% peluang dieksploitasi; lebih tinggi dari 84,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5215/ advisory vendor
• https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware product
• https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware product