TP-Link's support team has issued a security advisory for a command execution vulnerability in the TP-Link AXE75 OpenVPN in the Archer AXE75 V1, with the identifier CVE-2026-9044. According to the company, an attacker on the same network with valid credentials could, under certain conditions, cause arbitrary command execution via a "tampered" VPN configuration file.
TP-Link's official advisory rates the issue as High (CVSS v4.0 8.5) and emphasizes that the exploit requires the attacker to be adjacency (i.e. have access to the local network) and authenticated. More technical details are provided in the company's own advisory (TP-Link Security Advisory).
See also: TRENDnet TEW-821DAP: Two new OS command injection CVEs in EOL router
TP-Link AXE75 OpenVPN: what exactly is the problem?
As described in the CVE record, the vulnerability concerns the VPN subsystem and is related to inadequate filtering of special characters when importing a VPN client configuration file. This could allow a user with administrative access to input data that, when processed by the device, leads to OS command injection and command execution in the router's operating system (CVE.org).
In practice, such vulnerabilities in home networking devices become more dangerous when the environment has “loose” access: shared Wi-Fi, guests, or admin accounts that never change. Even if the perpetrator has to be on the same network, the scenario is not uncommon in small offices, lodgings, or homes with many IoT devices.
The SecNews technical team reminds us that the safest way to use a VPN on a router is to minimize “entry points”: disable features you don’t use, keep the management interface outside of the guest Wi-Fi, and prefer strong authentication. If the device supports it, consider using a separate user with limited permissions for daily settings.
TP-Link states that a successful exploitation could lead to complete control of the device, with potential consequences for configuration, network security, and service availability (TP-Link).
Which versions are affected and what is the fix?
The official announcement concerns the Archer AXE75 with hardware V1. To address this, TP-Link refers to a firmware upgrade to stable version 1.5.6 Build 20260623, which is explicitly listed as "fixed" for the CVE (TP-Link advisory).
If you are using the VPN function on your router, it is worth checking immediately: (a) the exact model and hardware revision, (b) the current firmware version, and (c) whether you have OpenVPN configuration import/export enabled. The SecNews editorial team points out that in such errors, even when authentication is required, the “chain” of risk can start from weak passwords or third-party access to Wi-Fi.
See also: How to secure your Wi-Fi in 10 minutes
What to do now (practical steps)
In addition to immediately upgrading to the patched firmware, it is recommended to limit management access to trusted devices only, disable any remote management you don't need, and use a strong, unique password for the admin account. If using a VPN is necessary, prefer to import settings only from files you have created yourself and avoid "ready-made" profiles circulating on forums.
Finally, it is a good idea to monitor the manufacturer's announcements for new updates and possible additional clarifications regarding the exploit. The SecNews technical team will continue to monitor the progress of CVE-2026-9044 (and its appearance in the NVD when full details are published) in order to inform if there are any indications of active malicious exploitation.
Especially for users who rely on remote access, the challenge is not to “fall behind” the firmware: when an advisory appears for TP-Link AXE75 OpenVPN, a delay of a few weeks can leave the network exposed to attacks that start from a simple Wi-Fi access. A quick update check per month and activating notifications from the manufacturer significantly reduce the risk.
See also: RustDuck Botnet compromises routers and servers for DDoS
The main conclusion is that even “local” vulnerabilities in routers can turn into a serious problem when the environment has weak credentials or poor network segmentation. Especially for devices that act as a gateway for the entire home or small business network, firmware updates are not optional — they are the first and most effective level of defense.
