EUVD-2026-20550
GHSA-28h6-3mx2-8gjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to TP-Link Archer AX53
-
ExploitUpload crafted dnsmasq configuration file
-
ExecutionTrigger OS command injection in parser
-
ImpactExecute arbitrary code on device
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated administrative access to TP-Link Archer AX53 v1.0 (before firmware 1.7.1 Build 20260213). Attacker must upload or process a specially crafted dnsmasq configuration file through the device's web interface or management API. Adjacent network access required. |
| Impact | CVSS 8.5 reflects high impact (confidentiality, integrity, availability) but requires authenticated adjacent attacker with high privileges. Attack surface limited to adjacent networks; patch available. Priority depends on deployment density in trusted network environments and patch adoption velocity. |
| Exploit ScenarioDerived | Authenticated admin uploads malicious dnsmasq configuration file via device interface. OS command injection in configuration parsing executes arbitrary code with device privileges, enabling system compromise. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
OS command injection in TP-Link Archer AX53 v1.0 dnsmasq module allows authenticated adjacent attackers to execute arbitrary code through maliciously crafted configuration files. Successful exploitation enables device configuration modification, sensitive data access, and complete system compromise. Affects TP-Link Archer AX53 v1.0 firmware versions prior to 1.7.1 Build 20260213. Requires high-privilege adjacent network access (CVSS:4.0 AV:A/PR:H). No public exploit identified at time of analysis.
RemediationAI
Vendor-released patch: Upgrade TP-Link Archer AX53 v1.0 firmware to version 1.7.1 Build 20260213 or later. Download firmware from official TP-Link support portal at https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware. Verify firmware authenticity before installation. As interim mitigation for unpatched systems, restrict administrative access to trusted adjacent network segments only, disable remote management interfaces, and audit dnsmasq configuration files for unauthorized modifications. Consult vendor security advisory at https://www.tp-link.com/us/support/faq/5055/ for additional guidance. No workaround fully eliminates risk; patching is mandatory for production environments.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-78 command injection in dnsmasq configuration parser fails to sanitize user-supplied input before passing to system shell. Vulnerability resides in cpe:2.3:a:tp-link_systems_inc.:ax53_v1.0 firmware component processing DNS configuration parameters. CVSS 8.5 reflects adjacent network vector requiring administrative credentials but yielding high confidentiality/integrity/availability impact with limited subsequent system compromise.
Know when Ax53 V1 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
2DescriptionCVE.org
An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow the attacker to modify device configuration, access sensitive information, or further compromise system integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
Executive ViewAI
TP-Link Archer AX53 v1.0 routers running firmware prior to version 1.7.1 Build 20260213 contain a command injection vulnerability in the dnsmasq module that allows privileged network-adjacent attackers to execute arbitrary code and compromise device integrity. Organizations using affected routers risk unauthorized configuration changes, data exfiltration, and loss of network perimeter security, particularly in environments where administrative access controls may be inadequate.
Apply vendor patch: TP-Link Archer AX53 firmware version 1.7.1 Build 20260213 or later. Interim mitigations if patching is delayed: (1) Restrict administrative network access to trusted IP ranges via firewall rules; (2) Disable remote management features if not required; (3) Monitor dnsmasq process logs for anomalous configuration changes; (4) Implement network segmentation to isolate affected devices from sensitive systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
OS command injection in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to execute arbit
Stack-based buffer overflow in TP-Link Archer AX53 v1.0 tmpServer module enables authenticated adjacent attackers to exe
External configuration control in TP-Link AX53 v1.0 OpenVPN module allows authenticated adjacent attackers to read arbit
External control of configuration in TP-Link Archer AX53 v1.0 OpenVPN module allows authenticated adjacent attackers wit
Exploit-DB