EUVD-2026-20546
GHSA-xxqc-mrq8-7966
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
AnalysisAI
External control of configuration in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers with high privileges to read arbitrary files via malicious configuration file processing, exposing sensitive device information. CVSS 6.8 reflects high confidentiality impact; no public exploit code or active exploitation confirmed. Patch available: firmware version 1.7.1 Build 20260213 or later.
Technical ContextAI
The vulnerability exists in the OpenVPN configuration processing logic of TP-Link Archer AX53 v1.0 routers. CWE-15 (External Control of System or Configuration Setting) indicates the device fails to properly validate or sanitize configuration file inputs before processing them. When a malicious OpenVPN configuration file is uploaded or processed by a high-privilege authenticated user on the adjacent network (AV:A - adjacent network vector), the OpenVPN module may interpret specially crafted directives to access files outside the intended scope, bypassing normal file access controls. The CVSS 4.0 vector shows low attack complexity (AC:L), no special timing/tools required (AT:N), and high confidentiality impact (VC:H) with no integrity or availability impact, confirming a read-only file disclosure vulnerability.
RemediationAI
Vendor-released patch: upgrade TP-Link Archer AX53 v1.0 firmware to version 1.7.1 Build 20260213 or later. Download the patched firmware from TP-Link's official support page (https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware) and apply via the router's web administration panel or firmware update utility. As an interim measure, restrict OpenVPN configuration uploads and modifications to trusted administrators only, and regularly audit which users have high-privilege access to the device. Monitor for any suspicious file access patterns or unexpected configuration changes in system logs.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbit
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbit
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to exe
External configuration control in TP-Link AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to read arbit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today