Vulnerability · Published Apr 8, 2026 · Assigned by TPLink

CVE-2026-30815OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53

High 8.5

In plain English

A high-severity OS command injection in AX53 v1.0 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)1.6%top 23.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity. This issue affects AX53 v1.0: before 1.7.1 Build 20260213.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	AX53 v1.0	0 – before 1.7.1 Build 20260213

Weakness: CWE-78 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

In plain English

Official description

Affected products (as reported)

References