An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers.

CVE-2026-9044 is an OS command injection flaw (CWE-78) in the OpenVPN configuration import function of the TP-Link Archer AXE75 V1 consumer Wi-Fi router. All firmware versions prior to 1.5.6 Build 20260623 are affected. An attacker who is already on the same LAN segment *and* has valid admin credentials can import a specially crafted .ovpn configuration file containing shell metacharacters that the router's VPN module fails to sanitize, achieving arbitrary command execution as root on the embedded Linux OS.

TP-Link tagged this CVSS v4.0 8.5 / HIGH, but that label overstates the real-world risk for enterprise defenders. The vector (AV:A/PR:H) means the attacker must already be adjacent *and* hold admin privileges — two preconditions that, combined, dramatically shrink the exploitable population. If an attacker already has your router's admin password and is on your LAN, you have bigger problems than a config-file injection. For an enterprise fleet, the AXE75 is a consumer device that rarely appears outside home offices or shadow-IT deployments, further limiting blast radius.

Why this verdict

• Adjacent + admin auth compounds to near-zero reachability. AV:A means no internet-facing attack surface. PR:H means the attacker already owns the device's admin account. Together, these prerequisites place this firmly below HIGH for any realistic enterprise threat model.
• Consumer device, not enterprise infrastructure. The Archer AXE75 is a ~$120 consumer Wi-Fi 6E router. It does not appear in enterprise procurement catalogs, is not managed by enterprise MDM/UEM, and would only surface as shadow IT in home offices or branch closets.
• Role multiplier: negligible enterprise role. The AXE75 is not a network edge appliance in the enterprise sense (not FortiGate, PAN-OS, ASA). In a home-office scenario it is the perimeter device, but compromise of a single remote worker's home router does not yield domain takeover, fleet compromise, or supply-chain pivot. Blast radius: single device → single home LAN segment. This does not trigger the HIGH floor.
• No PoC, no KEV, bottom-decile EPSS (0.97%). There is zero evidence of weaponization or attacker interest. The exploitation probability model places this in the lowest tier.

Why not higher?

To reach HIGH, the vulnerability would need either (a) a realistic path to compromise enterprise-critical infrastructure, (b) active exploitation or KEV listing, or (c) unauthenticated or remote attack surface. None of these apply. The AXE75 is a consumer device requiring LAN adjacency and admin credentials — two prerequisites that each independently narrow the population below meaningful enterprise risk thresholds.

Why not lower?

The underlying flaw is genuine root-level command injection (CWE-78), and if exploited, grants complete device control including traffic interception and DNS hijacking for the LAN segment. In a work-from-home scenario where sensitive corporate traffic traverses the compromised router, the confidentiality impact is real. Dropping to LOW would understate the impact *given successful exploitation*, even though the path to get there is narrow.

1. Change default admin credentials on all AXE75 routers — The PR:H prerequisite means credential hygiene is the primary gate. Ensure all deployed AXE75 units use strong, unique admin passwords. This alone blocks the attack chain. No mitigation SLA applies at MEDIUM — go straight to remediation.
2. Update firmware to 1.5.6 Build 20260623 — The patch has been available since June 2026. Push firmware updates to any AXE75 units managed or tracked by IT. For BYOD/home-office routers, issue guidance to affected remote workers within the 365-day noisgate remediation window.
3. Disable remote management if enabled — Although remote management is off by default, verify it hasn't been toggled on. This ensures the admin interface remains LAN-only, preserving the AV:A constraint.
4. Inventory shadow-IT consumer routers in branch offices — If your asset inventory doesn't track consumer-grade routers, you can't patch what you don't know about. Run a network scan for TP-Link OUI MAC prefixes on branch subnets.

Run this script from any Linux/macOS host on the same LAN as the target AXE75 router. Pass the router's IP as the first argument: bash check_axe75_cve2026_9044.sh 192.168.0.1. No special privileges required — it queries the router's web interface for firmware version information.

#!/usr/bin/env bash
# check_axe75_cve2026_9044.sh — Check TP-Link Archer AXE75 V1 for CVE-2026-9044
# Usage: bash check_axe75_cve2026_9044.sh <router_ip>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

ROUTER_IP="${1:-}"
if [ -z "$ROUTER_IP" ]; then
  echo "Usage: $0 <router_ip>"
  exit 2
fi

echo "[*] Querying TP-Link Archer AXE75 at $ROUTER_IP ..."

# Attempt to grab firmware version from the login page or device info endpoint
# TP-Link routers often expose model/firmware in the login page HTML or via CGI
RESPONSE=$(curl -sk --connect-timeout 5 --max-time 10 "http://$ROUTER_IP/" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "[!] Could not connect to $ROUTER_IP"
  echo "UNKNOWN"
  exit 2
fi

# Check if this is an AXE75
if ! echo "$RESPONSE" | grep -qi 'AXE75\|Archer AXE75'; then
  echo "[!] Device at $ROUTER_IP does not appear to be an Archer AXE75"
  echo "UNKNOWN"
  exit 2
fi

# Try to extract firmware version (format: X.Y.Z Build YYYYMMDD)
FW_VERSION=$(echo "$RESPONSE" | grep -oiP '\d+\.\d+\.\d+\s*Build\s*\d{8}' | head -1)

if [ -z "$FW_VERSION" ]; then
  echo "[!] Could not extract firmware version from web interface."
  echo "[!] Manual check required: log in to http://$ROUTER_IP and check"
  echo "    Advanced > System > Firmware Update for version >= 1.5.6 Build 20260623"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected firmware: $FW_VERSION"

# Extract major.minor.patch and build date
FW_NUM=$(echo "$FW_VERSION" | grep -oP '\d+\.\d+\.\d+' | head -1)
BUILD_DATE=$(echo "$FW_VERSION" | grep -oP '\d{8}' | head -1)

# Compare: fixed version is 1.5.6 Build 20260623
# Simple comparison via build date (YYYYMMDD)
FIXED_BUILD=20260623

if [ "$BUILD_DATE" -ge "$FIXED_BUILD" ] 2>/dev/null; then
  echo "[+] Firmware build date $BUILD_DATE >= $FIXED_BUILD (fixed)"
  echo "PATCHED"
  exit 0
else
  echo "[-] Firmware build date $BUILD_DATE < $FIXED_BUILD (vulnerable)"
  echo "[-] CVE-2026-9044: OS command injection in VPN module"
  echo "[-] Update to firmware 1.5.6 Build 20260623 or later"
  echo "VULNERABLE"
  exit 1
fi

Sources

1. TP-Link Security Advisory (CVE-2026-9044)
2. SecNews.gr — TP-Link AXE75 OpenVPN CVE-2026-9044
3. THREATINT CVE-2026-9044 Detail
4. TP-Link Product Security Advisory Index
5. TP-Link Archer AXE75 Firmware Downloads
6. NVD — CVE-2026-22225 (related AXE75 vuln)
7. TP-Link Archer AXE75 Product Page