This vulnerability (CVE-2026-30815) affects the OpenVPN module in TP-Link Archer AX53 v1.0 devices running firmware versions prior to 1.7.1 Build 20260213. It arises from improper neutralization of special elements in OS commands (CWE-78), allowing an authenticated adjacent attacker to inject and execute arbitrary system commands when a maliciously crafted OpenVPN configuration file is processed. The issue stems from insufficient input validation in the OpenVPN module. Successful exploitation may result in unauthorized modification of device configuration, exposure of sensitive data, or further compromise of device integrity. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An authenticated attacker on an adjacent network can exploit this vulnerability to execute arbitrary system commands on the affected device. This can lead to unauthorized modification of configuration files, disclosure of sensitive information, and further compromise of the device's security and operational integrity. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interfaces to trusted users only and avoid processing untrusted OpenVPN configuration files. Monitor vendor channels for updates and apply firmware updates promptly once available.