CVE-2026-9044

HighCVSS 8.0/10Last modified Oct 23, 2026

Description

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters.

Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-904408.2Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.n CVE-2026-904418.1A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil CVE-2026-904435.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does no CVE-2026-904448.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An CVE-2026-904456.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted CVE-2026-904464.3An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request CVE-2026-904476.5A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppli CVE-2026-904486.5A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restr CVE-2026-904496.5When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface CVE-2026-90457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo CVE-2026-904504.3The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role re CVE-2026-904515.9An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled