An OS command injection flaw exists in the OpenVPN module of the TP‑Link Archer AX53 v1.0 firmware. An attacker who is authenticated and adjacent on the same network can craft a malicious configuration file that, when processed by the device, causes arbitrary shell commands to be executed. The vulnerability is a classic example of CWE‑78 and enables an attacker to alter device settings, extract sensitive information, or further compromise the device’s integrity.

The ARSeries router model TP‑Link Archer AX53 running firmware version 1.0, specifically before firmware 1.7.1 Build 20260213, is affected. Only this combination of vendor, product, and firmware version is listed in the CNA data.

The CVSS score of 8.5 indicates a high severity. The EPSS score is below 1 %, suggesting a currently low likelihood of automated exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The vendor notes the attacker must be authenticated on an adjacent network segment, meaning the primary attack vector is via a local, connected attacker who can upload or influence a configuration file on the router.