CVE-2026-9151 is an OS command injection vulnerability (CWE-78) in the VPN module of TP-Link Archer AX12 v1, AX17 v1, AX18 v1, and AX1300 v1.6 routers. It allows an adjacent attacker with authentication to execute arbitrary OS commands by importing a malicious VPN client configuration file. The root cause is improper neutralization of special elements in the input, enabling command injection. The vulnerability has a CVSS 4.0 score of 8.5, indicating high severity. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation enables an attacker to execute arbitrary commands on the affected device, potentially gaining full control. This compromises device configuration integrity, network security, and service availability. The attacker must be adjacent to the device network and authenticated to exploit the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the VPN configuration import functionality to trusted users only and monitor for suspicious activity related to VPN configuration imports.