Critical severity · published Mar 20, 2026
CVE-2025-15607
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation…
9.8
CVSS
2%
EPSS
No
On KEV
Description
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
AA
Archer Ax53 Firmware
Tp-link
More from Archer Ax53 Firmware
9.8
CVE-2025-15608
This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a…
8.8
CVE-2026-0834
Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands…
8.1
CVE-2025-62501
SSH Hostkey Misconfiguration Vulnerability in Archer Devices
8.0
CVE-2026-30818
OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53
8.0
CVE-2026-30815
OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53