TP-Link AXE75 CVE-2026-9044

Exploitation requires two hard prerequisites: the attacker must be on the same network segment as the target router (adjacent network, AV:A - remote internet-based attackers are excluded), and must hold authenticated administrator-level access to the TP-Link AXE75 V1 management interface (PR:H - low-privilege or unauthenticated users cannot exploit this). The specific attack trigger is the VPN client configuration import feature within the VPN module; exploitation is not possible without access to this functionality. The primary limiting factors are the authentication barrier (PR:H) and network adjacency requirement: routers with unique strong admin passwords are protected against credential-reuse attacks, and attackers without physical or logical presence on the LAN or WLAN cannot reach the management interface. Exploitation does not require any user interaction beyond the attacker's own administrative session.

The CVSS 4.0 score of 8.5 with vector AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L reflects a meaningful but constrained threat. Two signals significantly limit real-world risk: the adjacent network vector (AV:A) restricts attackers to the same network segment, and the high privilege requirement (PR:H) demands prior administrative authentication - meaning this is a post-compromise escalation or insider-threat scenario rather than an initial access vector. AC:L and AT:N confirm exploitation itself is mechanically straightforward once prerequisites are met. Full C/H/I:H/VA:H impact on the router is consistent with root-level command execution on an embedded device. Subsequent-system impact (SC:L/SI:L/SA:L) reflects that downstream network segments may be partially affected - traffic interception or rerouting is plausible once the router is under attacker control. EPSS data is not available in the input; KEV status is absent, indicating no confirmed active exploitation. No POC code is referenced. Combined, this is a real-severity vulnerability with a narrow exploitation window constrained by authentication and network adjacency.

An attacker who has obtained administrator credentials - through credential reuse, phishing, or a default-password attack - and is connected to the same network segment as the AXE75 V1 logs into the router management interface and navigates to the VPN module. The attacker uploads a crafted VPN client configuration file containing embedded shell metacharacters (e.g., semicolons, backticks, or pipes) in a configuration field. The router's VPN processing code passes the unsanitized value to an OS command interpreter, executing the attacker's injected commands with root-level privileges.