An external control of configuration vulnerability in the OpenVPN module of TP-Link AX53 v1.0 allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.
Successful
exploitation may allow unauthorized access to arbitrary files on the device,
potentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
An OS command injection vulnerability in the OpenVPN module
of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to execute system commands when a specially crafted configuration file is processed due to insufficient input validation. Successful exploitation may allow modification of configuration files, disclosure of sensitive information, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent attacker to trigger a segmentation fault and potentially execute arbitrary code via a specially crafted configuration file. Successful exploitation may cause a crash and could allow arbitrary code execution, enabling modification of device state, exposure of sensitive data, or further compromise of device integrity.
This issue affects AX53 v1.0: before 1.7.1 Build 20260213.
A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.
CVE-2026-34122 is a stack-based buffer overflow vulnerability in TP-Link Tapo C520WS v2.6 caused by insufficient input validation in a configuration handling component. An attacker can trigger this by providing an excessively long configuration parameter value, leading to a stack overflow. Successful exploitation results in a denial-of-service condition, causing the device to crash or reboot and impacting availability. There is no information on an available patch or vendor advisory. No known exploits are reported in the wild.
CVE-2026-34121 is an authentication bypass vulnerability in TP-Link Tapo C520WS version 2.6. It arises from inconsistent parsing and authorization logic in JSON requests handled by the device's DS configuration service. An unauthenticated attacker can exploit this flaw by appending an authentication-exempt action to requests containing privileged actions, thereby bypassing authorization checks. Successful exploitation allows unauthorized execution of restricted configuration changes on the device, potentially altering its state without proper credentials. The vulnerability has a high severity rating with a CVSS score of 8.7. No official patch or remediation guidance is currently provided by the vendor. The device is not a cloud service, so remediation depends on vendor updates or user action. There are no known exploits in the wild at this time.
CVE-2026-34120 is a heap-based buffer overflow vulnerability in TP-Link Tapo C520WS v2.6. It occurs during asynchronous parsing of local video stream content due to improper buffer boundary validation. An attacker on the same network segment can send crafted payloads to trigger heap memory corruption, leading to a denial-of-service (DoS) condition where the device process crashes or becomes unresponsive. The vulnerability has a high severity score of 7.1. No patch or official remediation information is currently available.
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing
loop
when appending segmented request bodies without
continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker
on the same network segment could trigger heap memory corruption conditions by
sending crafted payloads that cause write operations beyond allocated buffer
boundaries. Successful exploitation
causes a Denial-of-Service (DoS) condition, causing the device’s process to
crash or become unresponsive.
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C210 v3.6 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input.
An attacker
on the same network segment could trigger heap memory corruption conditions by
sending crafted payloads that cause write operations beyond allocated buffer
boundaries. Successful exploitation
causes a Denial-of-Service (DoS) condition, causing the device’s process to
crash or become unresponsive.
CVE-2026-4346 is a vulnerability in TP-Link TL-WR850N v3 routers that involves cleartext storage of administrative and Wi-Fi credentials in flash memory. The device’s serial interface remains enabled and is protected by weak authentication, allowing an attacker with physical access and serial port connectivity to extract sensitive information. Exploiting this vulnerability can lead to full administrative control of the router and unauthorized access to the wireless network. The CVSS score is 5.1, indicating a medium severity level. No patch or official remediation is currently documented.
CVE-2026-3622 is a high-severity vulnerability in the UPnP component of TP-Link TL-WR841N v14 routers. It arises from improper input validation that causes an out-of-bounds read, potentially crashing the UPnP service. Exploitation leads to a denial-of-service condition by disrupting the UPnP functionality. This affects versions prior to EN_0.9.1 4.19 Build 260303 Rel.42399n and US_0.9.1.
CVE-2025-15606 is a high-severity Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 router. It arises from improper input validation (CWE-20), allowing an attacker to send crafted HTTP requests that cause the httpd service to crash, resulting in service interruption. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to availability. The CVSS 4.0 score is 7.1, reflecting its high impact and ease of exploitation. Organizations relying on this router model may experience network outages or degraded service. Mitigation involves applying vendor patches once available, restricting access to the device's management interface, and monitoring for unusual HTTP traffic patterns.
CVE-2025-15605 is a high-severity vulnerability in TP-Link Archer NX series routers, including NX200, NX210, NX500, and NX600 v3.0, caused by a hardcoded cryptographic key used in the device configuration mechanism. An authenticated attacker with low privileges can decrypt, modify, and re-encrypt configuration files, compromising the confidentiality and integrity of device settings. Exploitation does not require user interaction but does require authentication. No known exploits are currently in the wild. This vulnerability affects the security posture of impacted devices by enabling unauthorized configuration changes, potentially leading to network compromise or persistent backdoors. Organizations using these devices should prioritize mitigation steps such as firmware updates, restricting access to management interfaces, and monitoring configuration changes. Countries with significant TP-Link market penetration and strategic reliance on these devices are at higher risk. The CVSS v4.0 score is 8.
CVE-2025-15519 is a high-severity OS command injection vulnerability affecting TP-Link Archer NX600 v3.0 and related models. It arises from improper input validation in an administrative CLI command used for modem management. An authenticated attacker with administrative privileges can inject and execute arbitrary OS commands, compromising device confidentiality, integrity, and availability. Exploitation requires no user interaction but does require high-level privileges. This vulnerability impacts multiple TP-Link Archer models, including NX200, NX210, NX500, and NX600. No known public exploits exist yet, but the CVSS 4.0 score of 8.5 reflects significant risk. Organizations relying on these devices for network connectivity face potential device takeover and network disruption.
CVE-2025-15518 is a high-severity OS command injection vulnerability affecting TP-Link Archer NX600 v3.0 and related models. It arises from improper input handling in a wireless-control administrative CLI command, allowing an authenticated attacker with administrative privileges to execute arbitrary OS commands. Exploitation compromises device confidentiality, integrity, and availability. No user interaction is required beyond authentication, and the vulnerability does not require network-level access beyond administrative privileges. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to affected devices. The CVSS 4.0 score is 8.5, reflecting high impact and relatively low attack complexity. Organizations using these TP-Link devices should prioritize patching or mitigating this vulnerability to prevent potential device takeover and network compromise.
CVE-2025-15517 is a high-severity vulnerability affecting TP-Link Archer NX600 v3.0 and related models, caused by missing authentication checks on certain HTTP CGI endpoints. This flaw allows unauthenticated attackers to perform privileged actions such as firmware uploads and configuration changes without requiring any credentials or user interaction. The vulnerability impacts multiple models including NX200, NX210, NX500, and NX600, exposing critical router management functions to remote exploitation. The CVSS 4.0 score of 8.6 reflects the high impact on confidentiality and integrity with no authentication or user interaction needed, though the attack vector is adjacent network. No known exploits are currently reported in the wild. Organizations using these TP-Link devices risk unauthorized control over network infrastructure, potentially leading to persistent compromise, network disruption, or interception of sensitive data. Mitigation requires immediate firmware updates from the vendor once available, network segmentation to limit access to router management interfaces, and monitoring for suspicious HTTP requests targeting vulnerable endpoints.
This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques.
Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing.
Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.
The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.
