{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3atp_linkarcher_ax17_v1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tp_link:archer_ax17_v1:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-9151"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Archer AX17 v1 (\u003c 1.5.0 Build 20260605)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","network-device"],"_cs_type":"advisory","_cs_vendors":["TP-Link"],"content_html":"\u003cp\u003eCVE-2026-9151 is an authenticated OS command injection vulnerability in the Archer AX17 v1 VPN client import functionality. The issue arises because the profile description field is insufficiently sanitized and later processed by system commands (\u003ccode\u003egrep\u003c/code\u003e and \u003ccode\u003esed\u003c/code\u003e) running with root privileges. An authenticated administrative session from the LAN is required to exploit this.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes an authenticated administrative session on the LAN.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the VPN client import functionality on the router.\u003c/li\u003e\n\u003cli\u003eAttacker submits a crafted OpenVPN profile description containing a payload using backticks and \u003ccode\u003e${IFS}\u003c/code\u003e to bypass input filtering (e.g., \u003ccode\u003e`sleep${IFS}1`\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe router stores the malicious string as a filename in \u003ccode\u003e/etc/openvpn/.ovpn\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application writes the path to \u003ccode\u003e/tmp/ovpn_curr_edit\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe web server executes \u003ccode\u003egrep\u003c/code\u003e and \u003ccode\u003esed\u003c/code\u003e commands using the unquoted path from \u003ccode\u003e/tmp/ovpn_curr_edit\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe system shell interprets the injected backticks as commands, executing the payload with root privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full command execution on the router as the root user, potentially leading to a complete compromise of the network device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Archer AX17 v1 firmware to version 1.5.0 Build 20260605 or later.\u003c/li\u003e\n\u003cli\u003eLimit administrative access to the router web interface to trusted management subnets or hardened endpoints to mitigate the risk of an attacker gaining the required administrative session.\u003c/li\u003e\n\u003cli\u003eAudit logs for unexpected administrative logins or configuration changes on network devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T23:10:24Z","date_published":"2026-11-01T23:10:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-archer-ax17-command-injection/","summary":"An authenticated OS command injection vulnerability in the TP-Link Archer AX17 router allows administrative LAN users to achieve root command execution via malicious OpenVPN client profile descriptions.","title":"TP-Link Archer AX17: Authenticated OS command injection (CVE-2026-9151)","url":"https://feed.craftedsignal.io/briefs/2026-11-archer-ax17-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:tp_link:archer_ax17_v1:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}