This vulnerability involves external control of system or configuration settings (CWE-15) in the OpenVPN module of TP-Link AX53 v1.0 routers. An attacker with adjacent network access and authentication privileges can supply a malicious OpenVPN configuration file that the device processes, enabling the attacker to read arbitrary files on the device. This could expose sensitive information stored on the device. The issue affects firmware versions before 1.7.1 Build 20260213. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no user interaction, and high impact on confidentiality. No official patch or remediation level has been published by TP-Link as of the data provided.

Successful exploitation allows an authenticated adjacent attacker to read arbitrary files on the affected device, potentially exposing sensitive information. This compromises confidentiality but does not indicate impact on integrity or availability. The vulnerability requires authentication and adjacent network access, limiting the attack surface. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interfaces to trusted networks and authenticated users only. Monitor for updates from TP-Link regarding firmware updates addressing this vulnerability.