Which versions of Ax53 V1 are affected by EUVD-2025-208905?

CVE-2025-15607 presents moderate security risk, a command injection vulnerability rated CVSS 7.3.. A patch is available.

How to fix or mitigate EUVD-2025-208905?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Ax53 V1 EUVD-2025-208905

Q: What is the CVSS score of EUVD-2025-208905?

EUVD-2025-208905 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2025-15607 HIGH

Command Injection (CWE-77)

2026-03-20 TPLink

Command Injection Ax53 V1

7.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 16:45 euvd

EUVD-2025-208905

Analysis Generated

Mar 20, 2026 - 16:45 vuln.today

Patch released

Mar 20, 2026 - 16:45 nvd

Patch available

CVE Published

Mar 20, 2026 - 16:31 nvd

HIGH 7.3

DescriptionCVE.org

A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.

AnalysisAI

A command injection vulnerability exists in TP-Link AX53 v1 devices within the mscd debug functionality that allows authenticated attackers to execute arbitrary commands with full device control. The vulnerability stems from insufficient input validation on log redirection parameters, which can be abused to concatenate unvalidated file content into shell commands. A vendor patch is available, and this represents a critical control-plane compromise vector for affected router devices.

Technical ContextAI

The vulnerability resides in the mscd (likely a proprietary management/debug service) component of TP-Link's AX53 v1 firmware (CPE: cpe:2.3:a:tp-link_systems_inc.:ax53_v1:*:*:*:*:*:*:*:*). The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection weakness. The vulnerability is exploitable through debug functionality that accepts user-controlled log redirection parameters without proper sanitization. An authenticated attacker can leverage log redirection to write content to arbitrary file paths and then cause that file content to be interpreted as part of shell command execution, achieving arbitrary code execution on the device. This represents a classic command injection pattern where user input is not neutralized before being passed to a shell interpreter.

RemediationAI

Immediately upgrade AX53 v1 firmware to the latest patched version available from TP-Link's official firmware download page (https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware). Verify the firmware version matches the patch release indicated in the vendor advisory (https://www.tp-link.com/us/support/faq/5025/). As an interim mitigation for devices not yet patched, restrict administrative access to the router's management interface (web UI and SSH) to trusted IP addresses only, disable remote management features if not required, and rotate weak or default credentials. Monitor device logs for any suspicious authentication attempts or unexpected command execution. Prioritize patching within 30 days to close the authentication-gated code execution window.