EUVD-2026-20546
GHSA-xxqc-mrq8-7966
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Impact | CVSS 6.8 indicates moderate-to-high severity, but real-world risk is constrained by multiple factors: (1) Attack Vector = Adjacent (AV:A) limits reach to local network attackers, not internet-wide; (2) Privilege Requirement = High (PR:H) means only administrators or high-privilege users can exploit it; (3) No public exploit code identified and no KEV (CISA Known Exploited Vulnerabilities) listing, suggesting low active exploitation probability despite the authenticated adjacent context. The confidentiality impact (VC:H) is the only damage vector, making this a targeted risk for organizations where administrative compromise or insider threats are concerns. EPSS data not provided; however, the adjacent + high-privilege requirements and confidentiality-only impact suggest this is lower priority than remotely exploitable unauthenticated vulns of similar CVSS. Organizations with strong network segmentation and admin credential protection can mitigate significantly. |
| Exploit ScenarioDerived | An authenticated administrator on the adjacent network (e.g., connected to the same LAN as the TP-Link Archer AX53) uploads a specially crafted OpenVPN configuration file containing directives that exploit path traversal or file reference weaknesses in the module's parser. Upon processing, the malicious config causes the device to read sensitive files such as /etc/passwd, system certificates, or stored credentials, which are then exfiltrated or displayed in logs/errors. No public POC exists, but any attacker with router admin credentials or ability to convince an admin to import a malicious config file can trigger the vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
External control of configuration in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers with high privileges to read arbitrary files via malicious configuration file processing, exposing sensitive device information. CVSS 6.8 reflects high confidentiality impact; no public exploit code or active exploitation confirmed. Patch available: firmware version 1.7.1 Build 20260213 or later.
RemediationAI
Vendor-released patch: upgrade TP-Link Archer AX53 v1.0 firmware to version 1.7.1 Build 20260213 or later. Download the patched firmware from TP-Link's official support page (https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware) and apply via the router's web administration panel or firmware update utility. As an interim measure, restrict OpenVPN configuration uploads and modifications to trusted administrators only, and regularly audit which users have high-privilege access to the device. Monitor for any suspicious file access patterns or unexpected configuration changes in system logs.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the OpenVPN configuration processing logic of TP-Link Archer AX53 v1.0 routers. CWE-15 (External Control of System or Configuration Setting) indicates the device fails to properly validate or sanitize configuration file inputs before processing them. When a malicious OpenVPN configuration file is uploaded or processed by a high-privilege authenticated user on the adjacent network (AV:A - adjacent network vector), the OpenVPN module may interpret specially crafted directives to access files outside the intended scope, bypassing normal file access controls. The CVSS 4.0 vector shows low attack complexity (AC:L), no special timing/tools required (AT:N), and high confidentiality impact (VC:H) with no integrity or availability impact, confirming a read-only file disclosure vulnerability.
Know when Ax53 V1 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbit
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbit
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to exe
External configuration control in TP-Link AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to read arbit
Exploit-DB