CVE-2026-30815

CVE-2026-30815 is an OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 routers, caused by insufficient input validation when processing specially crafted configuration files. An authenticated adjacent attacker can exploit this flaw to execute arbitrary system commands, potentially leading to unauthorized modification of device configurations, disclosure of sensitive information, or further compromise of device integrity. The vulnerability affects Archer AX53 v1.0 devices running firmware versions prior to 1.7.1 Build 20260213. The vulnerability carries a CVSS score of 8.0 (HIGH) with an adjacent network attack vector, low attack complexity, and low privilege requirements. Successful exploitation grants the attacker high confidentiality, integrity, and availability impact, meaning full system compromise is possible. User interaction is not required for exploitation, making this a significant risk in networked environments where the attacker has local network access. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and has not been designated as a priority on public vulnerability hot lists. The EPSS score of 0.00158 indicates this CVE is currently in the lower percentile for exploitation probability compared to the broader vulnerability landscape. Organizations managing TP-Link Archer AX53 v1.0 devices should prioritize patching to the latest firmware version as a standard security measure.