Vulnerability · Published Mar 20, 2026 · Assigned by TPLink

CVE-2025-15608Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55

High 7.7

In plain English

A high-severity stack buffer overflow in AX53 v1 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.6%top 49.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	AX53 v1	0 – before 251029
TP-Link Systems Inc.	AX55 v4	0 – before (US)_1.2.1 Build 20260527
TP-Link Systems Inc.	AX55 v4.6	0 – before (US)_1.2.1 Build 20260527

Weakness: CWE-121 · Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

In plain English

Official description

Affected products (as reported)

References