This vulnerability involves external control of system or configuration settings (CWE-15) in the OpenVPN module of TP-Link AX53 v1.0 routers. An authenticated attacker on an adjacent network can supply a malicious configuration file that is processed by the device, enabling arbitrary file read access. The affected versions are those before firmware 1.7.1 Build 20260213. The CVSS 4.0 base score is 6.8, reflecting medium severity with attack vector adjacent network, low attack complexity, no privileges required beyond high privileges, and high impact on confidentiality.

Successful exploitation allows an attacker with authenticated adjacent network access to read arbitrary files on the device, potentially exposing sensitive information. This could compromise confidentiality of device data. There is no indication of impact on integrity or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's OpenVPN configuration interface to trusted users only and monitor for suspicious configuration changes. Avoid processing untrusted configuration files. Follow updates from TP-Link for firmware updates addressing this issue.