Skip to content
OpenAdvisories
High · 8.5 Public exploit CVE-2026-9151 EUVD-2026-36078GHSA-x4j3-73c9-wq9c

Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers

Published Jun 10, 2026 · Updated Jun 11, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Archer AX12 V1 Product: Archer AX1300 v1.6 Product: Archer AX17 v1 Product: Archer AX18 v1 Category: Network devices

Description

An OS
command injection vulnerability exists in the VPN module of TP-Link Archer AX12
v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an
adjacent, authenticated attacker to execute arbitrary commands on the device by
importing a specially crafted VPN client configuration file. The issue stems
from improper filtering of special characters. 

Successful
exploitation of this vulnerability may enable an attacker to gain full control
of the affected device, potentially compromising configuration integrity,
network security, and service availability.

Affected products

VendorProductAffectedFixed
TP-Link Systems Archer AX12 V1 < V1_1.5.0 Build 20260605 V1_1.5.0 Build 20260605
TP-Link Systems Archer AX18 v1 < V1_1.5.0 Build 20260605 V1_1.5.0 Build 20260605
TP Link Systems Archer AX17 v1 < V1_1.5.0 Build 20260605 V1_1.5.0 Build 20260605
TP-Link Systems Archer AX1300 v1.6 < V1_1.5.0 Build 20260605 V1_1.5.0 Build 20260605

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • hcbt/CVE-2026-9151 ★ 0 · Nov 1, 2026

    Authenticated OS command injection in the TP-Link Archer AX17 v1 VPN client import.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References