This vulnerability (CVE-2026-30817) involves external control of system or configuration settings (CWE-15) in the OpenVPN module of TP-Link AX53 v1.0 routers. An attacker with authentication and adjacent network access can supply a malicious OpenVPN configuration file that causes the device to read arbitrary files. This can lead to unauthorized disclosure of sensitive information stored on the device. The issue affects firmware versions prior to 1.7.1 Build 20260213. The CVSS 4.0 base score is 6.8, reflecting medium severity with attack vector limited to adjacent network and requiring high privileges.

Successful exploitation allows an authenticated attacker on the adjacent network to read arbitrary files on the affected device. This could expose sensitive information stored on the router. There is no indication of remote exploitation without authentication or privilege escalation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is documented, users should monitor TP-Link advisories for firmware updates addressing this issue. Restricting access to the device's management interfaces and limiting trusted users may reduce risk until a patch is available.