An OS command injection flaw exists in the OpenVPN module of the TP‑Link Archer AX53 v1.0 firmware. An attacker who is authenticated and adjacent on the same network can craft a malicious configuration file that, when processed by the device, causes arbitrary shell commands to be executed. The vulnerability is a classic example of CWE‑78 and enables an attacker to alter device settings, extract sensitive information, or further compromise the device’s integrity.

The TP‑Link Archer AX53 running firmware version 1.0, specifically before firmware 1.7.1 Build 20260213, is affected. Only this combination of vendor, product, and firmware version is listed in the CNA data.

The CVSS score of 8.5 indicates a high severity. The EPSS score is 1 %, suggesting a currently low likelihood of automated exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The description states that the attacker must be authenticated and adjacent, which implies that the attack vector is likely local; this inference is drawn from the requirement that the attacker be able to access the router’s configuration interface. A locally connected attacker could therefore upload or influence a configuration file on the router to trigger the command injection.