TP-Link Archer AXE75 Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the web module of the TP-Link Archer AXE75 router, specifically in versions 1.0, 1.6, and through 1.3.2 Build 20250107. This vulnerability allows an authenticated attacker with adjacent-network access to execute remote code on the router, but only when it is configured as an access point. Successful exploitation grants root-level privileges and affects the device's overall functionality and security.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device, with the executed code running with root privileges.

Remediation

Users are advised to update to the latest firmware version. The latest firmware for the Archer AXE75 can be downloaded from the TP-Link official website.