CVE-2026-9044

Received Received - Intake

OS Command Injection in TP-Link AXE75 V1 Router VPN Module

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: TPLink

Description

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-9044

EUVD

EUVD-2026-51669

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	axe75	v1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in TP-Link AXE75 V1 routers. It allows an adjacent, authenticated attacker to run arbitrary commands by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters in the VPN module.

Detection Guidance

This vulnerability requires detecting improper filtering in the VPN module of TP-Link AXE75 V1 routers. Check for unusual VPN client configuration file imports or unexpected command execution patterns. Monitor logs for suspicious activity related to VPN configuration parsing. No specific commands are provided in the context.

Impact Analysis

Exploitation may let an attacker gain full control of the router. This could compromise configuration integrity, network security, and service availability, potentially exposing connected devices and data to unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized access and control of network devices, potentially exposing sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security) by compromising confidentiality and integrity of stored or transmitted information.

Mitigation Strategies

Update the TP-Link AXE75 V1 router firmware to the latest version to patch the OS command injection vulnerability in the VPN module. Disable VPN client configuration file imports from untrusted sources and restrict access to authenticated users only.

Hi! I’m here to help you understand CVE-2026-9044. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70