RCE in Tp Link Systems Inc. Archer Ax17 V1
CVE-2026-9151
An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.011 (61.4th percentile) — read the EPSS interpretation.
Affected products
- Tp Link Systems Inc. Archer Ax17 V1 — versions 0
- Tp-link Systems Inc. Archer Ax12 V1 — versions 0
- Tp-link Systems Inc. Archer Ax1300 V1.6 — versions 0
- Tp-link Systems Inc. Archer Ax18 V1 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory)