The vulnerability is a command injection flaw in the VPN module of certain TP‑Link Archer routers. An authenticated attacker on the local network can craft a special VPN client configuration file that, when processed, allows arbitrary operating‑system commands to run on the router. This can lead to full control of the device, compromising the routing configuration, network security posture, and service availability. The weakness corresponds to CWE‑78, improper filtering of shell characters.

Affected models include TP‑Link Archer AX12 v1, Archer AX17 v1, Archer AX18 v1, and Archer AX1300 v1.6. All are TP‑Link routers running proprietary firmware that incorporates the vulnerable VPN module. Users should be aware that the flaw exists in the versions listed and any delivery of configuration files to the device.

The CVSS base score of 8.5 indicates high severity, while the EPSS score is not available, but the absence of a KEV listing does not diminish risk. Attack requires local network presence and pre‑existing authentication to the gateway, meaning it targets users who have some level of local access. Given these conditions, organizations with devices in such a configuration should treat the vulnerability as a high‑priority risk, as exploitation can result in device takeover and broader network compromise.