VulnSocial

CVE-2026-9151Exploit

LOWCVSS 8.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters.  Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-78

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-13); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-06-10: 1Mentions · 2026-06-13: 2Mentions · 2026-06-14: 1PoC Mentioned / Linked · 2026-06-13: 1PoC Mentioned / Linked · 2026-06-14: 1Exploit Tool / Code · 2026-06-13: 1Exploit Tool / Code · 2026-06-14: 1Technical Details · 2026-06-10: 1Technical Details · 2026-06-13: 206-1006-1306-14
Signal classification2 categories
Exploit
375.0%
Disclosure
125.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-06-101
Disclosure1
2026-06-132
Exploit2
2026-06-141
Exploit1
Full discourse4 posts
  • YogSotho@YogSoth0
    Exploit

    New exploits: **predator_w6x_upgraded.zip** | CVE-49195, CVE-49196, CVE-49199 **tenda_cx12l_upgraded.zip** | CVE-2026-11503, CVE-2026-11504 **tenda_f451_upgraded.zip** | CVE-2026-11556, CVE-2026-11557 **cisco_20230_upgraded.zip** | CVE-2026-20230 **tplink_archer_20269151_upgraded.zip** | CVE-2026-9151 #exploit #0days #CVE #CVSS #security #hacking

    Post summary

    The post announces a set of zip files linked to multiple CVEs, indicating the availability of exploit code. No evidence of active exploitation or patching is provided.

    111187769
    1.8K followersView on X
  • YogSotho@YogSoth0
    Exploit

    Neeeext: # CVE-2026-9151 Exploit Kit ## TP-Link Archer OpenVPN Command Injection Exploit Kit **CVE ID:** CVE-2026-9151 **CVSS v4.0:** 8.5 (High) **Affected Products:** TP-Link Archer AX12 v1, AX17 v1, AX18 v1, AX1300 v1.6 Will upload this to /0days this night. Stay tuned, will make the Oracle Peoplesoft exploit kit too. #exploit #0days #security #CVE #oracle #gibliz #CVSS #TPlink

    Post summary

    The author announces a forthcoming exploit kit for CVE‑2026‑9151, noting its CVSS score and affected TP‑Link devices, but provides no PoC details or evidence of active exploitation.

    11130385
    1.8K followersView on X
  • YogSotho@YogSoth0
    Exploit

    Exploit kit for CVE-2026-9151 is now available at https://gibliz.taile5d4a8.ts.net/0days/ #exploit #0days #RCE #CVE #CVSS #security #cyber

    Post summary

    An exploit kit for CVE-2026-9151 is publicly available, confirming functional exploitation code but no evidence of active attacks or patch availability.

    00010193
    928 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-9151 OS Command Injection in TP-Link Archer AX Series VPN Module https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-9151

    Post summary

    The entry announces CVE‑2026‑9151, describing an OS command injection vulnerability in TP‑Link Archer AX Series VPN module, without indicating patches, active exploitation, or proof‑of‑concepts.

    0000042
    4.0K followersView on X

Explore more

Back to dashboard