{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30815", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-03-05T17:35:52.174Z", "datePublished": "2026-04-08T17:52:29.336Z", "dateUpdated": "2026-05-07T15:47:04.878Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-04-08T17:52:29.336Z"}, "title": "OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "AX53 v1.0", "modules": ["openvpn"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.1 Build 20260213", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the OpenVPN module\nof TP-Link Archer AX53 v1.0\u00a0allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed\u00a0due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.\n\nThis issue affects AX53 v1.0: before 1.7.1 Build 20260213.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An OS command injection vulnerability in the OpenVPN module\nof TP-Link Archer AX53 v1.0&nbsp;allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed&nbsp;due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.\n<br><p>This issue affects AX53 v1.0: before 1.7.1 Build 20260213.</p>"}]}], "references": [{"url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://talosintelligence.com/vulnerability_reports/", "tags": ["third-party-advisory"]}, {"url": "https://www.tp-link.com/us/support/faq/5055/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L"}}], "credits": [{"lang": "en", "value": "Lilith >_> of Cisco Talos", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0-beta"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-30815"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T03:56:16.458Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2303"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2307"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2308"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2309"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-07T15:47:04.878Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2303"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2307"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2308"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2309"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-07T15:47:04.878Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30815", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T19:11:26.709340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:11:35.349Z"}}], "cna": {"title": "OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Lilith >_> of Cisco Talos"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "modules": ["openvpn"], "product": "AX53 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.1 Build 20260213", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://talosintelligence.com/vulnerability_reports/", "tags": ["third-party-advisory"]}, {"url": "https://www.tp-link.com/us/support/faq/5055/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.0-beta"}, "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the OpenVPN module\nof TP-Link Archer AX53 v1.0\u00a0allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed\u00a0due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.\n\nThis issue affects AX53 v1.0: before 1.7.1 Build 20260213.", "supportingMedia": [{"type": "text/html", "value": "An OS command injection vulnerability in the OpenVPN module\nof TP-Link Archer AX53 v1.0&nbsp;allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed&nbsp;due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.\n<br><p>This issue affects AX53 v1.0: before 1.7.1 Build 20260213.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-04-08T17:52:29.336Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30815", "state": "PUBLISHED", "dateUpdated": "2026-05-07T15:47:04.878Z", "dateReserved": "2026-03-05T17:35:52.174Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-04-08T17:52:29.336Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_ax53_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B096B7BB-7693-4C45-B5F7-8FD6E4969DCE", "versionEndExcluding": "1.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_ax53:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "5F3EA1D9-EB47-4785-9CF0-F2B51945917D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability in the OpenVPN module\nof TP-Link Archer AX53 v1.0\u00a0allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed\u00a0due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.\n\nThis issue affects AX53 v1.0: before 1.7.1 Build 20260213."}], "id": "CVE-2026-30815", "lastModified": "2026-05-07T16:16:18.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}, "published": "2026-04-08T19:25:20.320", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/5055/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2303"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2307"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2308"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2309"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.7.1 Build 20260213)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "AX53 v1.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "ax53_v1", "vendor": "tp-link"}], "analysis": {"en": {"generated_at": "2026-04-14T17:48:22.650088+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware release (v1.7.1 Build\u202f20260213 or newer) to the TP\u2011Link Archer AX53 router. ", "If an immediate firmware upgrade is not possible, disable the OpenVPN service or lock it down so only trusted users can manage the configuration. ", "Restrict network access to the router\u2019s configuration interface to known administrators, ensuring that no unauthorized users can submit configuration files. ", "Verify firmware downloads using checksums or digital signatures provided by TP\u2011Link before installation. ", "Continuously monitor the device for unauthorized configuration changes or anomalous command execution logs."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The ARSeries router model TP\u2011Link Archer AX53 running firmware version 1.0, specifically before firmware 1.7.1 Build\u202f20260213, is affected. Only this combination of vendor, product, and firmware version is listed in the CNA data.", "description_and_impact": "An OS command injection flaw exists in the OpenVPN module of the TP\u2011Link Archer AX53 v1.0 firmware. An attacker who is authenticated and adjacent on the same network can craft a malicious configuration file that, when processed by the device, causes arbitrary shell commands to be executed. The vulnerability is a classic example of CWE\u201178 and enables an attacker to alter device settings, extract sensitive information, or further compromise the device\u2019s integrity.", "risk_and_exploitability": "The CVSS score of 8.5 indicates a high severity. The EPSS score is below 1\u202f%, suggesting a currently low likelihood of automated exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. The vendor notes the attacker must be authenticated on an adjacent network segment, meaning the primary attack vector is via a local, connected attacker who can upload or influence a configuration file on the router."}}}}, "created": "2026-04-09T08:18:36.025871+00:00", "updated": "2026-04-15T16:15:11.928888+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$ax53_v1"]}