EUVD-2026-20548
GHSA-wmw7-jpm9-rmff
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
An external configuration control vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary files when a malicious configuration file is processed. Successful exploitation may allow unauthorized access to arbitrary files on the device, potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
AnalysisAI
External configuration control in TP-Link AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to read arbitrary files by processing malicious configuration files, exposing sensitive device information. The vulnerability affects AX53 v1.0 prior to firmware build 1.7.1 Build 20260213 and requires high-level authentication and network adjacency to exploit. A vendor-released patch is available.
Technical ContextAI
The vulnerability exists in the OpenVPN module configuration handling of TP-Link AX53 wireless routers. It is classified as CWE-15 (External Control of System or Device Configuration), which indicates improper validation or sanitization of configuration file inputs. When a malicious OpenVPN configuration file is processed by the device, an authenticated user with high privileges on an adjacent network can manipulate the configuration to trigger arbitrary file read operations. This reflects a failure to implement proper input validation and access controls on configuration file processing, allowing configuration parameters to be abused for file system traversal or direct file access.
RemediationAI
Vendor-released patch: Upgrade TP-Link AX53 v1.0 firmware to version 1.7.1 Build 20260213 or later. Firmware updates are available from TP-Link's official support pages (https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware for Malaysia region and https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware for international). Restrict OpenVPN configuration upload and modification to trusted administrators only. Review and validate any OpenVPN configuration files before importing them into the device. Detailed FAQ guidance is available at https://www.tp-link.com/us/support/faq/5055/.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbit
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbit
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to exe
External control of configuration in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers wit
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today