Vulnerability · Published May 20, 2025 · Assigned by INCIBE
CVE-2025-40634Stack-based buffer overflow in TP-Link Archer AX50
Critical 9.2
In plain English
A critical-severity stack buffer overflow in Link Archer AX50 from TP-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the device over LAN and WAN networks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link | Link Archer AX50 | 0 – before 1.0.15 build 241203 rel61480 |
Weakness: CWE-121 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N