Carlcamel

**Name of the Vulnerable Software and Affected Versions** TP-Link AXE75 V1 (affected versions not specified) **Description** An OS command injection flaw exists in the VPN module. This issue occurs due to improper filtering of special characters, allowing an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. Successful exploitation may lead to full control of the device, compromising configuration integrity, network security, and service availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Archer BE230 versions prior to 1.2.4 Build 20251218 rel.70420 TP-Link Archer AXE75 v1 versions prior to 1.5.6 Build 20260623 **Description** An OS command injection issue exists within the VPN modules of the affected devices. This flaw allows an adjacent authenticated attacker to execute arbitrary code, potentially granting full administrative control over the device. Such exploitation can lead to a severe compromise of network security, service availability, and configuration integrity. This issue is one of several distinct command injection flaws identified across different code paths. **Recommendations** Update TP-Link Archer BE230 to version 1.2.4 Build 20251218 rel.70420 or later. Update TP-Link Archer AXE75 v1 to version 1.5.6 Build 20260623 or later. As a temporary mitigation, restrict access to the VPN modules to minimize the risk of exploitation.