PT-2026-48516 · Tp Link · Archer Ax18+3
CVSS v4.0
8.5
High
| Vector | AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
TP-Link Archer AX12 v1
TP-Link Archer AX17 v1
TP-Link Archer AX18 v1
TP-Link Archer AX1300 v1.6
Description
An OS command injection issue exists in the VPN module. This occurs due to improper filtering of special characters, allowing an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. Successful exploitation may enable an attacker to gain full control of the device, potentially compromising configuration integrity, network security, and service availability.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Archer Ax12
Archer Ax1300
Archer Ax17
Archer Ax18