CVE-2026-9151: Command Injection Vulnerability in OpenVPN on Multiple TP-Link Archer Routers

Synopsis

An OS command injection vulnerability exists in the VPN module of multiple TP-Link Archer routers (AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6). The flaw is reachable from an adjacent network segment and requires the attacker to be authenticated with administrative credentials; exploitation is triggered by importing a specially crafted OpenVPN client configuration file containing unfiltered special characters. Successful exploitation gives the attacker arbitrary OS command execution on the device, enabling full control over configuration, connected network traffic, and service availability. A patched-image rebuild at firmware version V1_1.5.0 Build 20260605 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be present on the same adjacent network segment, such as a LAN or VPN, rather than reaching the device from an arbitrary point on the internet.

• AuthenticationRequired

  The attacker must hold an administrative account on the router; low-privilege credentials are not sufficient to access the VPN configuration import function.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker triggers execution directly by submitting the malicious configuration file.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or environmental preconditions are required beyond network adjacency and admin credentials.

Blast Radius

• The attacker gains arbitrary OS command execution on the router and takes full administrative control of the device.
• Stored router configuration, including credentials, VPN keys, and firewall rules, is readable and modifiable by the attacker.
• The attacker can redirect, inspect, or drop all network traffic passing through the device, compromising the security of every host on the connected LAN.
• The router's routing and VPN services can be disrupted or disabled, causing a loss of network connectivity for all attached clients.