EUVD-2026-20544
GHSA-57xx-hp7r-53h8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to TP-Link Archer AX53
-
ExploitUpload malicious OpenVPN configuration file
-
ExecutionTrigger configuration parsing without validation
-
ImpactExecute arbitrary OS commands as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated access with high-privilege admin role on TP-Link Archer AX53 v1.0 (before firmware 1.7.1 Build 20260213). Attacker must be adjacent network-connected and upload a specially crafted OpenVPN configuration file to trigger OS command injection during processing. |
| Impact | High-severity command injection on adjacent networks requiring high privileges and manual configuration upload. CVSS 8.5 reflects significant local impact but authentication and network proximity limit blast radius. No KEV/POC signals observed. Priority for network-isolated deployments; lower for enterprise environments with segmentation. |
| Exploit ScenarioDerived | Authenticated administrator uploads malicious OpenVPN configuration file to AX53 v1.0 web interface. Device processes file without sanitization, executing embedded OS commands with device privileges, enabling configuration tampering or credential extraction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbitrary system commands through maliciously crafted configuration files. Exploitation requires high-privilege adjacency access but enables complete device compromise including configuration modification, credential disclosure, and persistent backdoor installation. Affects AX53 v1.0 firmware prior to 1.7.1 Build 20260213. No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: firmware version 1.7.1 Build 20260213. Immediately upgrade to patched firmware available from TP-Link official support portal at https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware. Interim mitigations: disable OpenVPN server functionality if not operationally required, restrict administrative interface access to trusted IP ranges via router ACLs, enforce strong WPA3 authentication on wireless networks to prevent adjacency access, monitor device logs for unauthorized configuration changes. Detailed vendor security advisory available at https://www.tp-link.com/us/support/faq/5055/. Adjacent network positioning requirement limits remote exploitation; prioritize patching in environments with untrusted local network users.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection vulnerability stems from insufficient input sanitization in OpenVPN configuration parser. CVSS:4.0 Adjacent Vector (AV:A) with High Privileges Required (PR:H) indicates attacker must possess administrative credentials on local network segment. Unvalidated parameters passed directly to shell execution context enable command chaining via metacharacters in uploaded .ovpn configuration files.
Know when Ax53 V1 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
Executive ViewAI
TP-Link Archer AX53 v1.0 routers contain a command injection vulnerability in the OpenVPN module that allows adjacent network attackers with authentication credentials to execute arbitrary commands and fully compromise the device. Organizations relying on these routers for network access control, VPN termination, or sensitive data transit face immediate risk of unauthorized configuration changes, credential theft, and persistent backdoor installation by authenticated threat actors on the local network.
Apply vendor patch. If immediate patching is unavailable: (1) Restrict network access to router management interfaces via firewall rules and access control lists to authorized administrative subnets only; (2) disable OpenVPN module if not required for business operations; (3) enforce strong authentication credentials and disable default credentials; (4) monitor router configuration changes and command execution logs for anomalies; (5) isolate affected routers to separate VLAN with limited lateral movement capability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbit
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to exe
External configuration control in TP-Link AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to read arbit
External control of configuration in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers wit
Exploit-DB