This vulnerability affects the OpenVPN module in TP-Link AX53 v1.0 routers prior to firmware version 1.7.1 Build 20260213. An authenticated attacker with adjacent network access can supply a malicious configuration file that causes the device to read arbitrary files. This is due to improper external control of system or configuration settings (CWE-15). The CVSS 4.0 base score is 6.8 (medium severity), reflecting the need for authentication and adjacency but low attack complexity and high impact on confidentiality. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated adjacent attacker to read arbitrary files on the affected device, potentially exposing sensitive information stored on the router. This could lead to unauthorized disclosure of device configuration or other sensitive data. The impact is limited to confidentiality and requires authentication and adjacency, which reduces the overall risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interfaces to trusted users and networks only. Monitor for vendor updates and apply firmware version 1.7.1 Build 20260213 or later once available, as this version is indicated to address the issue.