EUVD-2026-20548
GHSA-wmw7-jpm9-rmff
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration Configuration hardening
|
| Impact | CVSS 6.8 with attack vector Adjacent (AV:A) and high privilege requirement (PR:H) indicates moderate severity in isolated network environments. EPSS and KEV status are not provided, so real-world exploitation probability cannot be directly assessed. The attack requires both authentication (PR:H) and network adjacency, significantly limiting opportunistic exploitation; however, the high confidentiality impact (VC:H) means successful exploitation within these constraints yields complete file disclosure. The modifier flags are marked as X (unknown), which limits precision in environmental assessment. Risk is primarily contextual to networks where high-privilege users may be compromised or untrusted, or where the adjacent network boundary is permeable. This is not a remote unauthenticated vulnerability and should be lower priority than RCE or unauthenticated access flaws, but remains significant for environments with sensitive data stored on these routers. |
| Exploit ScenarioDerived | A high-privilege authenticated user on a network adjacent to a TP-Link AX53 v1.0 router crafts a malicious OpenVPN configuration file and uploads it to the device. Upon processing, the configuration exploits path traversal or file access logic in the OpenVPN module to read sensitive files such as /etc/passwd, system logs, or stored credentials. The attacker gains access to unencrypted sensitive information stored on the router, potentially including WiFi passwords, VPN credentials, or system configurations. No public exploit code or active exploitation has been confirmed; this scenario assumes an insider or compromised high-privilege account on the adjacent network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
External configuration control in TP-Link AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to read arbitrary files by processing malicious configuration files, exposing sensitive device information. The vulnerability affects AX53 v1.0 prior to firmware build 1.7.1 Build 20260213 and requires high-level authentication and network adjacency to exploit. A vendor-released patch is available.
RemediationAI
Vendor-released patch: Upgrade TP-Link AX53 v1.0 firmware to version 1.7.1 Build 20260213 or later. Firmware updates are available from TP-Link's official support pages (https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware for Malaysia region and https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware for international). Restrict OpenVPN configuration upload and modification to trusted administrators only. Review and validate any OpenVPN configuration files before importing them into the device. Detailed FAQ guidance is available at https://www.tp-link.com/us/support/faq/5055/.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the OpenVPN module configuration handling of TP-Link AX53 wireless routers. It is classified as CWE-15 (External Control of System or Device Configuration), which indicates improper validation or sanitization of configuration file inputs. When a malicious OpenVPN configuration file is processed by the device, an authenticated user with high privileges on an adjacent network can manipulate the configuration to trigger arbitrary file read operations. This reflects a failure to implement proper input validation and access controls on configuration file processing, allowing configuration parameters to be abused for file system traversal or direct file access.
Know when Ax53 V1 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbit
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbit
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to exe
External control of configuration in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers wit
Exploit-DB