TP-Link Archer EUVD-2026-36078

Exploitation requires three concrete preconditions drawn from the CVE data: (1) the attacker must be on a network adjacent to the router - same LAN segment, Wi-Fi (including guest SSID if it can reach the admin interface), or a directly bridged link - because the CVSS vector is AV:A, not AV:N; (2) the attacker must possess administrator-level credentials to the router web UI (PR:H), since the VPN client configuration import is an authenticated management function; (3) the device must be one of the listed hardware revisions (Archer AX12 v1, AX17 v1, AX18 v1, AX1300 v1.6) with the VPN Client feature enabled and reachable, and the attacker must be able to submit a crafted VPN client configuration file through that import workflow. No user interaction by another party is required (UI:N). Limiting factors that reduce real-world risk: admin credential requirement blocks pure outsiders, adjacency requirement blocks internet-wide scanning, and homes/offices that never enable the VPN client function present a smaller attack surface even pre-patch.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N) tells a nuanced story: attack vector is Adjacent (the attacker must already be on the LAN or Wi-Fi), privileges required are High (administrative login to the router web UI is needed), and no user interaction is required once the attacker is in. Confidentiality/Integrity/Availability impact on the vulnerable system is High, but Subsequent System impact is only Low, reflecting that the router is itself the asset rather than a pivot into a fully separate trust boundary. EPSS data was not supplied and the CVE is not in CISA KEV, and no POC is referenced - so this is best characterized as a high-CVSS issue whose real-world risk is meaningfully bounded by the dual requirement of network adjacency plus admin credentials. The most realistic threat models are an insider/guest on the Wi-Fi who has obtained or defaults-guessed the admin password, or chaining with a separate credential-disclosure or auth-bypass flaw; opportunistic mass exploitation is unlikely. No conflicting signals were observed in the supplied data.

An attacker who has gained the router's administrator credentials - for example a malicious guest on the home or small-office Wi-Fi, a roommate, or someone who phished or default-guessed the admin password - logs into the web UI and navigates to the VPN client configuration page. They upload a crafted VPN client profile in which a parameter (such as a server name, certificate path, or auth field) embeds shell metacharacters and an OS command; when the firmware parses and applies the file, the injected command runs with router-level privileges, giving the attacker a persistent foothold to sniff or redirect LAN traffic, alter DNS, or install a backdoor. No public exploit is identified at time of analysis, so the attacker would need to develop the payload from scratch.