CVE-2026-9044

High

Description

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

SeverityHigh

CVSS8.0

Exploit probability—

Product

Tp-link Archer Axe75 Firmware

PublishedJul 31, 2026

First seenJul 31, 2026

Weakness typeCWE-78OS command injection

How to fix

Update

tp-link archer_axe75_firmware1.5.6 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/5215/

Affected products

Product	Affected versions	Fixed in
tp-link archer_axe75_firmware	v < 1.5.6	1.5.6

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.