This vulnerability (CVE-2026-30815) affects TP-Link Archer AX53 v1.0 routers running firmware versions prior to 1.7.1 Build 20260213. It is caused by improper neutralization of special elements in the OpenVPN module, leading to OS command injection when processing maliciously crafted configuration files. An attacker with authenticated adjacent network access can exploit this flaw to execute arbitrary system commands, potentially modifying configuration files, exposing sensitive data, or compromising the device further. The CVSS 4.0 vector indicates low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available, and the remediation level is unspecified.

Successful exploitation allows an authenticated adjacent attacker to execute arbitrary system commands on the affected device. This can result in unauthorized modification of configuration files, disclosure of sensitive information, and further compromise of the device's integrity and operation. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated access to the device and carefully validate any OpenVPN configuration files before processing. Monitor for vendor updates regarding patches or official mitigations.