Read the docs
TI-2025-14235 Aliases CVE-2025-15607GHSA-jmm8-8444-c942

Authenticated Command Injection in mcsd Service of TP-Link Archer AX53

Priority LOW 38CWE-77Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01941 80th percentileScored 2026-11-07
Fix Fixed AX53 v1 (TP-Link Systems Inc.): 251029

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkAX53 v1before 251029251029Patch availableCNA
  • AX53 v1 VendorTP-Link Affected before 251029 Fixed in 251029 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*1.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

  • Fix · CNA AX53 v1 (TP-Link Systems Inc.) Fixed in 251029

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems AX53 v1 — tp-link.com/us/support/faq/5025

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-14236 Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55Priority LOW 37
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15607
  2. 2026-10-03 Alias added: GHSA-jmm8-8444-c942

References

Patch 1

Advisory 1

  • TI-2026-00615 Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13 CVSS 4.0HIGH 7.2
  • TI-2026-23644 OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 CVSS 4.0HIGH 8.5
  • TI-2026-23647 OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 CVSS 4.0HIGH 8.5
  • TI-2025-38874 Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12 CVSS 4.0HIGH 8.6
  • TI-2025-14236 Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55 CVSS 4.0HIGH 7.7
  • TI-2025-38672 Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53 CVSS 4.0HIGH 7.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences