EUVD-2026-51669
GHSA-4v8f-3c7h-9xrw
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector and high privileges reflect on-segment admin access requirement; unchanged scope since subsequent-system impact is marginal (SC:L/SI:L/SA:L in 4.0).
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters.
Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.
AnalysisAI
OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers allows an adjacent, authenticated attacker with administrator-level access to achieve full device compromise by importing a specially crafted VPN client configuration file. Improper filtering of special characters (CWE-78) in configuration input permits injection of arbitrary OS commands, granting an attacker complete control over the device including configuration integrity, network routing, and service availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two hard prerequisites: the attacker must be on the same network segment as the target router (adjacent network, AV:A - remote internet-based attackers are excluded), and must hold authenticated administrator-level access to the TP-Link AXE75 V1 management interface (PR:H - low-privilege or unauthenticated users cannot exploit this). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.5 with vector AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L reflects a meaningful but constrained threat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained administrator credentials - through credential reuse, phishing, or a default-password attack - and is connected to the same network segment as the AXE75 V1 logs into the router management interface and navigates to the VPN module. The attacker uploads a crafted VPN client configuration file containing embedded shell metacharacters (e.g., semicolons, backticks, or pipes) in a configuration field. … |
| Remediation | Apply the vendor-released firmware update for the TP-Link Archer AXE75 V1 immediately; the patched firmware is available at https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all TP-Link Archer AXE75 V1 devices in production and restrict access to VPN configuration import functions to essential personnel only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today