The vulnerability is an OS command injection in the VPN module of TP-Link Archer AXE75 V1 routers that allows a nearby authenticated attacker to supply a specially crafted VPN client configuration file. The injection flaw stems from inadequate filtering of special characters, which can be exploited to run arbitrary operating‑system commands. Successful exploitation can give the attacker complete control over the device, jeopardizing router configuration integrity, network security posture, and service availability.

TP-Link Systems Inc. Archer AXE75 V1 routers are impacted by this flaw. No further version granularity is specified beyond model V1.

The CVSS score of 8.5 signifies a high severity assessment. The EPSS score of less than 1% indicates a low current exploitation probability, however the vulnerability remains live and not yet listed in CISA KEV. Exploitation is likely limited to an adjacent, authenticated attacker on the same local network who can import a malicious VPN client configuration file; no remote unauthenticated vector is reported.