Which versions of Ax53 V1 0 are affected by CVE-2026-30818?

TP-Link Archer AX53 v1.0 routers running firmware prior to version 1.7.1 Build 20260213 contain a command injection vulnerability in the dnsmasq module that allows privileged network-adjacent…. A patch is available.

How to fix or mitigate CVE-2026-30818?

Within 24 hours: Inventory all TP-Link Archer AX53 v1.0 devices and document current firmware versions via device management consoles. Within 7 days: Prioritize firmware updates to version 1.7.1 Build 20260213 or later for all affected units; validate update integrity through TP-Link's official channels. Within 30 days: Audit network segmentation to restrict administrative access to routers, implement change logs for device configuration modifications, and conduct post-patch validation testing.

Ax53 V1 0 CVE-2026-30818

Q: What is the CVSS score of CVE-2026-30818?

CVE-2026-30818 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-20550 HIGH

OS Command Injection (CWE-78)

2026-04-08 TPLink

GHSA-28h6-3mx2-8gjg

TP-Link RCE Command Injection Ax53 V1 0

8.5

CVSS 4.0 · Vendor: TPLink

Severity by source

Vendor (TPLink) PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (TPLink) · only source for this CVE.

CVSS VectorVendor: TPLink

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 19:31 euvd

EUVD-2026-20550

Analysis Generated

Apr 08, 2026 - 19:31 vuln.today

Patch released

Apr 08, 2026 - 19:31 nvd

Patch available

CVE Published

Apr 08, 2026 - 17:54 nvd

HIGH 8.5

DescriptionCVE.org

An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow the attacker to modify device configuration, access sensitive information, or further compromise system integrity.

This issue affects AX53 v1.0: before 1.7.1 Build 20260213.

AnalysisAI

OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbitrary code through maliciously crafted configuration files. Successful exploitation enables device configuration modification, sensitive data access, and complete system compromise. Affects TP-Link Archer AX53 v1.0 firmware versions prior to 1.7.1 Build 20260213. Requires high-privilege adjacent network access (CVSS:4.0 AV:A/PR:H). No public exploit identified at time of analysis.

Technical ContextAI

CWE-78 command injection in dnsmasq configuration parser fails to sanitize user-supplied input before passing to system shell. Vulnerability resides in cpe:2.3:a:tp-link_systems_inc.:ax53_v1.0 firmware component processing DNS configuration parameters. CVSS 8.5 reflects adjacent network vector requiring administrative credentials but yielding high confidentiality/integrity/availability impact with limited subsequent system compromise.

RemediationAI

Vendor-released patch: Upgrade TP-Link Archer AX53 v1.0 firmware to version 1.7.1 Build 20260213 or later. Download firmware from official TP-Link support portal at https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware. Verify firmware authenticity before installation. As interim mitigation for unpatched systems, restrict administrative access to trusted adjacent network segments only, disable remote management interfaces, and audit dnsmasq configuration files for unauthorized modifications. Consult vendor security advisory at https://www.tp-link.com/us/support/faq/5055/ for additional guidance. No workaround fully eliminates risk; patching is mandatory for production environments.