Which versions of TP-Link Archer are affected by CVE-2026-9151?

TP-Link Archer AX12, AX17, AX18, and AX1300 routers contain an OS command injection vulnerability in the VPN configuration module that allows authenticated users on adjacent networks to execute…. A patch is available.

How to fix or mitigate CVE-2026-9151?

Within 24 hours: Inventory all TP-Link Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 devices in production environments. Within 7 days: Apply vendor-released firmware patches from TP-Link support for each affected model. Within 30 days: Verify all patches are deployed and validate VPN module functionality post-update.

TP-Link Archer CVE-2026-9151

Q: What is the CVSS score of CVE-2026-9151?

CVE-2026-9151 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36078 HIGH

OS Command Injection (CWE-78)

2026-06-10 TPLink

GHSA-x4j3-73c9-wq9c

Command Injection TP-Link

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:32 vuln.today

CVSS changed

Jun 10, 2026 - 18:22 NVD

8.5 (HIGH)

DescriptionNVD

An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters.

Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

AnalysisAI

OS command injection in the VPN module of TP-Link Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 routers allows an authenticated attacker on an adjacent network to execute arbitrary commands by uploading a malicious VPN client configuration file. The flaw stems from improper sanitization of special characters during configuration import (CWE-78) and carries a CVSS 4.0 base score of 8.5. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV, but TP-Link has released firmware fixes for all affected models.

Technical ContextAI

The affected devices are consumer/SOHO TP-Link Archer Wi-Fi routers (AX12, AX17, AX18, AX1300) running TP-Link's proprietary firmware, which embeds a VPN client capability allowing users to import third-party VPN configuration files (typically OpenVPN-style .ovpn or PPTP/L2TP profile files). The CWE-78 root cause indicates that fields parsed from the imported configuration file are passed through to an underlying OS shell - likely via a system()/popen()-style invocation of a VPN binary or helper script - without proper escaping or allow-listing of metacharacters such as backticks, semicolons, pipes, or $(...) substitution. Because the parsing occurs inside privileged daemons on embedded Linux, injected commands execute in the router's administrative context. The CPE strings confirm the issue is tied to specific hardware revisions (v1 / v1.6) rather than a software library shared across the product line.

RemediationAI

Patch available per vendor advisory: download and install the latest firmware for the exact hardware revision from the TP-Link support pages - Archer AX12 (https://www.tp-link.com/en/support/download/archer-ax12/#Firmware), Archer AX17 (https://www.tp-link.com/en/support/download/archer-ax17/#Firmware), Archer AX18 (https://www.tp-link.com/en/support/download/archer-ax18/#Firmware), and Archer AX1300 (https://www.tp-link.com/us/support/download/archer-ax1300/#Firmware) - verifying the hardware version label on the device before flashing, since installing the wrong revision's firmware can brick consumer routers. Exact fixed firmware version strings are not enumerated in the supplied input and should be read from the vendor pages above and the FAQ at https://www.tp-link.com/us/support/faq/5125/. Until patching is complete, reduce exposure by disabling the VPN Client feature in the router web UI if unused, rotating the administrator password to a strong unique value (the attacker needs admin), disabling Wi-Fi guest network access to the management VLAN or moving administration to a wired-only interface, and ensuring remote/cloud management is turned off so the adjacent-network requirement is not effectively widened; the trade-off of disabling the VPN client is loss of upstream VPN tunneling for the LAN.