Which versions of Ax53 V1 0 are affected by CVE-2026-30815?

TP-Link Archer AX53 v1.0 routers contain a command injection vulnerability in the OpenVPN module that allows adjacent network attackers with authentication credentials to execute arbitrary commands…. A patch is available.

How to fix or mitigate CVE-2026-30815?

Within 24 hours: Identify all TP-Link Archer AX53 v1.0 devices in production via asset inventory and network scanning; document current firmware versions. Within 7 days: Upgrade all affected devices to firmware version 1.7.1 Build 20260213 or later per TP-Link's vendor advisory; test in non-production environment first. Within 30 days: Conduct post-patch validation; review router access logs for suspicious activity; enforce network segmentation to restrict adjacent access to router management interfaces.

Ax53 V1 0 CVE-2026-30815

Q: What is the CVSS score of CVE-2026-30815?

CVE-2026-30815 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-20544 HIGH

OS Command Injection (CWE-78)

2026-04-08 TPLink

GHSA-57xx-hp7r-53h8

TP-Link Command Injection Ax53 V1 0

8.5

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (TPLink) · only source for this CVE.

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20544

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

Patch released

Apr 08, 2026 - 19:31 nvd

Patch available

CVE Published

Apr 08, 2026 - 17:52 nvd

HIGH 8.5

DescriptionCVE.org

An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.

This issue affects AX53 v1.0: before 1.7.1 Build 20260213.

AnalysisAI

OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbitrary system commands through maliciously crafted configuration files. Exploitation requires high-privilege adjacency access but enables complete device compromise including configuration modification, credential disclosure, and persistent backdoor installation. Affects AX53 v1.0 firmware prior to 1.7.1 Build 20260213. No public exploit identified at time of analysis.

Technical ContextAI

CWE-78 command injection vulnerability stems from insufficient input sanitization in OpenVPN configuration parser. CVSS:4.0 Adjacent Vector (AV:A) with High Privileges Required (PR:H) indicates attacker must possess administrative credentials on local network segment. Unvalidated parameters passed directly to shell execution context enable command chaining via metacharacters in uploaded .ovpn configuration files.

RemediationAI

Vendor-released patch: firmware version 1.7.1 Build 20260213. Immediately upgrade to patched firmware available from TP-Link official support portal at https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware. Interim mitigations: disable OpenVPN server functionality if not operationally required, restrict administrative interface access to trusted IP ranges via router ACLs, enforce strong WPA3 authentication on wireless networks to prevent adjacency access, monitor device logs for unauthorized configuration changes. Detailed vendor security advisory available at https://www.tp-link.com/us/support/faq/5055/. Adjacent network positioning requirement limits remote exploitation; prioritize patching in environments with untrusted local network users.