TP-Link Archer AX17: Authenticated OS command injection (CVE-2026-9151)

CVE-2026-9151 is an authenticated OS command injection vulnerability in the Archer AX17 v1 VPN client import functionality. The issue arises because the profile description field is insufficiently sanitized and later processed by system commands (grep and sed) running with root privileges. An authenticated administrative session from the LAN is required to exploit this.

Attack Chain

1. Attacker establishes an authenticated administrative session on the LAN.
2. Attacker triggers the VPN client import functionality on the router.
3. Attacker submits a crafted OpenVPN profile description containing a payload using backticks and ${IFS} to bypass input filtering (e.g., `sleep${IFS}1`).
4. The router stores the malicious string as a filename in /etc/openvpn/.ovpn.
5. The application writes the path to /tmp/ovpn_curr_edit.
6. The web server executes grep and sed commands using the unquoted path from /tmp/ovpn_curr_edit.
7. The system shell interprets the injected backticks as commands, executing the payload with root privileges.

Impact

Successful exploitation allows for full command execution on the router as the root user, potentially leading to a complete compromise of the network device.

Recommendation

• Update Archer AX17 v1 firmware to version 1.5.0 Build 20260605 or later.
• Limit administrative access to the router web interface to trusted management subnets or hardened endpoints to mitigate the risk of an attacker gaining the required administrative session.
• Audit logs for unexpected administrative logins or configuration changes on network devices.