Read the docs
TI-2025-14236 Aliases CVE-2025-15608GHSA-6mh6-q22w-5c4p

Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55

Priority LOW 37CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00638 50th percentileScored 2026-11-07
Fix Fixed AX53 v1 (TP-Link Systems Inc.): 251029AX55 v4 (TP-Link Systems Inc.): (US)_1.2.1 Build 20260527+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkAX53 v1before 251029251029Patch availableCNA
TP-LinkAX55 v4before (US)_1.2.1 Build 20260527(US)_1.2.1 Build 20260527Patch availableCNA
TP-LinkAX55 v4.6before (US)_1.2.1 Build 20260527(US)_1.2.1 Build 20260527Patch availableCNA
  • AX53 v1 VendorTP-Link Affected before 251029 Fixed in 251029 Patch available CNA
  • AX55 v4 VendorTP-Link Affected before (US)_1.2.1 Build 20260527 Fixed in (US)_1.2.1 Build 20260527 Patch available CNA
  • AX55 v4.6 VendorTP-Link Affected before (US)_1.2.1 Build 20260527 Fixed in (US)_1.2.1 Build 20260527 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*1.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_ax53:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

  • Fix · CNA AX53 v1 (TP-Link Systems Inc.) Fixed in 251029
  • Fix · CNA AX55 v4 (TP-Link Systems Inc.) Fixed in (US)_1.2.1 Build 20260527
  • Fix · CNA AX55 v4.6 (TP-Link Systems Inc.) Fixed in (US)_1.2.1 Build 20260527

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems AX53 v1 — tp-link.com/us/support/faq/5025

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-14235 Authenticated Command Injection in mcsd Service of TP-Link Archer AX53Priority LOW 38
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15608
  2. 2026-10-03 Alias added: GHSA-6mh6-q22w-5c4p
  3. 2026-10-18 EPSS moved to the 50th–90th percentile

References

Patch 4

Advisory 1

  • TI-2026-00615 Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13 CVSS 4.0HIGH 7.2
  • TI-2026-23644 OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53 CVSS 4.0HIGH 8.5
  • TI-2026-23647 OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53 CVSS 4.0HIGH 8.5
  • TI-2025-38874 Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12 CVSS 4.0HIGH 8.6
  • TI-2025-14235 Authenticated Command Injection in mcsd Service of TP-Link Archer AX53 CVSS 4.0HIGH 7.3
  • TI-2025-38672 Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53 CVSS 4.0HIGH 7.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences