High severity · published Apr 8, 2026
CVE-2026-30815
An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially…
8.0
CVSS
1.6%
EPSS
No
On KEV
Description
An OS command injection vulnerability in the OpenVPN module
of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Archer Ax53 Firmware · Tp-link
before 1.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30815
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30815
Third Party Advisory
https://talosintelligence.com/vulnerability_reports/
Product
https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware
Product
https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware
Vendor Advisory
https://www.tp-link.com/us/support/faq/5055/
www.talosintelligence.com
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2303
www.talosintelligence.com
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2307
More from Archer Ax53 Firmware
9.8
CVE-2025-15608
This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a…
9.8
CVE-2025-15607
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation…
8.8
CVE-2026-0834
Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands…
8.1
CVE-2025-62501
SSH Hostkey Misconfiguration Vulnerability in Archer Devices
8.0
CVE-2026-30814
A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute…