An authenticated command injection flaw exists in the mscd debug functionality of TP‑Link Archer AX53 v1. The flaw arises because the service does not properly validate input used for log redirection and for concatenating file contents into shell commands. An attacker who can authenticate to the service can craft requests that cause the router to execute arbitrary shell commands. Successful exploitation can lead to the attacker running malicious code and potentially taking full control of the device, compromising confidentiality, integrity, and availability.

TP‑Link Systems Inc. Archer AX53 router, firmware version 1.0 (v1). No other versions are listed as affected.

The CVSS score of 7.3 indicates a high severity vulnerability, while the EPSS score of 2% suggests that exploitation is relatively unlikely at this time. The flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have valid credentials to the device or to otherwise authenticate to the mscd service, after which the attack can be performed over the network. Because the flaw allows arbitrary command execution, the risk profile is significant if the device is exposed.