CVE-2026-9151: TP-Link Archer Router RCE Vulnerability

CVE-2026-9151 Overview

CVE-2026-9151 is an operating system (OS) command injection vulnerability in the VPN module of multiple TP-Link Archer routers. The flaw affects Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 devices. An adjacent, authenticated attacker can execute arbitrary commands by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters in user-supplied configuration input, classified under [CWE-78].

Successful exploitation grants full control of the affected device. Attackers can tamper with router configuration, intercept network traffic, and disrupt service availability.

Critical Impact

An authenticated attacker on the adjacent network can achieve arbitrary command execution on the router, leading to complete device takeover and downstream compromise of the network the router serves.

Affected Products

• TP-Link Archer AX12 v1 and Archer AX17 v1
• TP-Link Archer AX18 v1
• TP-Link Archer AX1300 v1.6

Discovery Timeline

• 2026-06-10 - CVE-2026-9151 published to the National Vulnerability Database (NVD)
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-9151

Vulnerability Analysis

The vulnerability resides in the VPN module responsible for parsing and applying imported VPN client configuration files. The module passes configuration values to underlying shell utilities without adequately sanitizing or filtering shell metacharacters. An authenticated administrative user with access to the router management interface can supply a crafted configuration file that embeds OS commands within parameters that the firmware later interprets as shell input.

Because router web services typically run with elevated privileges, injected commands execute in a high-privilege context. This grants the attacker the ability to modify firmware behavior, persist on the device, and pivot into the local network.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The VPN configuration import handler concatenates attacker-controlled values into shell command strings rather than using safe argument passing or strict allowlist validation. Characters such as ;, |, `, and $() are not filtered before reaching the command interpreter.

Attack Vector

Exploitation requires adjacency to the target, meaning the attacker must reside on the same logical or physical network as the router. The attacker must also hold authenticated credentials with permission to import VPN client configurations. After authenticating, the attacker uploads a configuration file containing shell metacharacters in fields the VPN module passes to the system shell. When the router parses the file, the injected commands execute on the device.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose per the TP-Link FAQ #5125 advisory.

Detection Methods for CVE-2026-9151

Indicators of Compromise

• Unexpected VPN client configuration imports in router administrative logs, particularly from unusual source addresses on the LAN or guest network.
• Outbound connections from the router itself to attacker infrastructure, indicating execution of injected commands.
• Unauthorized changes to router configuration, DNS settings, or firmware integrity after a VPN configuration import event.

Detection Strategies

• Inspect VPN configuration files for shell metacharacters such as ;, |, backticks, and $() in fields that should contain hostnames, paths, or numeric values.
• Correlate router administrative authentication events with subsequent VPN import actions to identify suspicious sequences.
• Monitor router syslog forwarding for command execution artifacts or shell error messages emitted during configuration parsing.

Monitoring Recommendations

• Forward router syslogs to a centralized logging platform and alert on VPN module errors or unexpected process activity.
• Track administrative session sources and flag access from non-management VLANs or guest networks.
• Baseline outbound traffic originating from the router management plane and alert on deviations.

How to Mitigate CVE-2026-9151

Immediate Actions Required

• Apply the firmware updates published by TP-Link for Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 from the vendor download portal.
• Restrict router administrative access to a dedicated management VLAN and disable remote administration from the WAN.
• Rotate administrative credentials and enforce strong, unique passwords on all affected devices.
• Audit existing VPN client configurations for unauthorized or suspicious entries.

Patch Information

TP-Link has published firmware updates on the product support pages. Download the latest firmware for the affected models from TP-Link Archer AX12 Firmware, TP-Link Archer AX17 Firmware, TP-Link Archer AX18 Firmware, and TP-Link Archer AX1300 Firmware. Refer to TP-Link FAQ #5125 for the official advisory and update guidance.

Workarounds

• Disable the VPN client feature on the router until firmware is updated if the function is not required.
• Limit administrative accounts to trusted personnel and remove any unused administrator accounts.
• Segment the router management interface from user and guest networks to reduce the adjacent attack surface.

# Configuration example - restrict management access (vendor UI varies)
# 1. Disable remote (WAN) management
# 2. Bind admin UI to a dedicated management VLAN only
# 3. Disable VPN client import until firmware update is applied