High severity · published Apr 8, 2026
CVE-2026-30818
OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53
8.0
CVSS
1.2%
EPSS
No
On KEV
Description
An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute arbitrary code when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow the attacker to modify device configuration, access sensitive information, or further compromise system integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
AX53 v1.0 · TP-Link Systems Inc.
before 1.7.1 Build 20260213 · source: vendor
AA
Archer Ax53 Firmware · Tp-link
before 1.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30818
Third Party Advisory
https://talosintelligence.com/vulnerability_reports/
Product
https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware
Product
https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware
Vendor Advisory
https://www.tp-link.com/us/support/faq/5055/
www.talosintelligence.com
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2306
More from AX53 v1.0
5.7
CVE-2026-30817
Arbitrary File Reading Vulnerability in dnsmasq Module in TP-Link AX53
5.7
CVE-2026-30816
Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53