PT-2026-31408 · Tp Link Systems+1 · Ax53 V1.0+1

Lilith >_> · Published 2026-04-08 · Updated 2026-05-07 · CVE-2026-30815

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX53 v1.0 versions prior to 1.7.1 Build 20260213

Description An OS command injection issue in the OpenVPN module allows an authenticated adjacent attacker to execute system commands. This occurs during the processing of a specially crafted configuration file due to insufficient input validation. Successful exploitation could lead to the modification of configuration files, disclosure of sensitive information, or compromise of device integrity.

Recommendations Update to version 1.7.1 Build 20260213 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-30815

Affected Products

Ax53 V1.0

Archer Ax53 Firmware

References · 10

• https://tp-link.com/us/support/faq/5055 · Vendor Advisory
• https://tp-link.com/my/support/download/archer-ax53/v1/#Firmware · Patch
• https://tp-link.com/en/support/download/archer-ax53/v1/#Firmware · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30815 · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2307 · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2308 · Note
• https://talosintelligence.com/vulnerability_reports · Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2309 · Note
• https://t.me/cveNotify/162575 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2303 · Note