CVE-2026-9151: Command Injection in TP-Link Archer VPN

CVE-2026-9151 affects TP-Link Archer: command injection via VPN config import.

CVE-2026-9151 is a command injection vulnerability in the VPN module of TP-Link Archer routers (models AX12 v1, AX17 v1, AX18 v1, AX1300 v1.6). An authenticated attacker on the local network can import a specially crafted VPN configuration file to execute arbitrary commands on the device, gaining full control and compromising configuration integrity, network security, and service availability.

The CVSS score is 8.5 (HIGH). The vulnerability was published on NVD on June 10, 2026. As of November 1, 2026, public GitHub repositories have declared that they contain functional exploits, indicating concrete risk of active exploitation. The vendor has not yet reported patch status; no firmware updates are currently available.

IT teams must identify affected Archer routers in the environment. Restrict access to VPN configuration import function to verified administrators only. If possible, disable the VPN module completely until an official patch is released. Continuously monitor device logs for suspicious activity or unexpected commands. Regularly check the TP-Link support website for firmware updates and security bulletins.

At a glance

What: Command injection in VPN module during import of specially crafted VPN configuration files by authenticated attacker on local network
Severity: CVSS 8.5 (HIGH): attacker can execute arbitrary commands and gain full device control
Affected versions: TP-Link Archer AX12 v1, AX17 v1, AX18 v1, AX1300 v1.6
Fix: Not reported: official patch not yet available from vendor
Status: Exploits declared on public GitHub repositories as of November 1, 2026; vulnerability published on NVD June 10, 2026
Action: Audit network for affected router models; restrict VPN import access to administrators only; disable VPN module where possible; monitor suspicious logs; check TP-Link support for patches

Sources: NVD, CVE-2026-9151

← All articles