EUVD-2025-208905
CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Tags
Description
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.
Analysis
A command injection vulnerability exists in TP-Link AX53 v1 devices within the mscd debug functionality that allows authenticated attackers to execute arbitrary commands with full device control. The vulnerability stems from insufficient input validation on log redirection parameters, which can be abused to concatenate unvalidated file content into shell commands. A vendor patch is available, and this represents a critical control-plane compromise vector for affected router devices.
Technical Context
The vulnerability resides in the mscd (likely a proprietary management/debug service) component of TP-Link's AX53 v1 firmware (CPE: cpe:2.3:a:tp-link_systems_inc.:ax53_v1:*:*:*:*:*:*:*:*). The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), a command injection weakness. The vulnerability is exploitable through debug functionality that accepts user-controlled log redirection parameters without proper sanitization. An authenticated attacker can leverage log redirection to write content to arbitrary file paths and then cause that file content to be interpreted as part of shell command execution, achieving arbitrary code execution on the device. This represents a classic command injection pattern where user input is not neutralized before being passed to a shell interpreter.
Affected Products
TP-Link Archer AX53 version 1 (AX53 v1) is the confirmed affected product, identified via CPE cpe:2.3:a:tp-link_systems_inc.:ax53_v1:*:*:*:*:*:*:*:*. The vulnerability impacts all firmware versions of this model prior to the patched release. Vendor support and firmware updates are available through TP-Link's official support portal at https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware, and additional advisory details are documented at https://www.tp-link.com/us/support/faq/5025/.
Remediation
Immediately upgrade AX53 v1 firmware to the latest patched version available from TP-Link's official firmware download page (https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware). Verify the firmware version matches the patch release indicated in the vendor advisory (https://www.tp-link.com/us/support/faq/5025/). As an interim mitigation for devices not yet patched, restrict administrative access to the router's management interface (web UI and SSH) to trusted IP addresses only, disable remote management features if not required, and rotate weak or default credentials. Monitor device logs for any suspicious authentication attempts or unexpected command execution. Prioritize patching within 30 days to close the authentication-gated code execution window.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today