The vulnerability resides in the OpenVPN module of TP‑Link AX53 firmware v1.0. An authenticated adjacent attacker can supply a crafted configuration file that, when processed, permits reading of arbitrary files on the device. This flaw enables unauthorized disclosure of sensitive data stored on the router, potentially exposing configuration secrets, credentials, or other confidential information.

TP‑Link AX53 routers running firmware version 1.0 are affected. The issue is present before firmware build 1.7.1 Build 20260213, so any device with a firmware release older than that is vulnerable.

The CVSS score of 6.8 indicates medium severity, and the lack of an EPSS rating means an exact exploitation likelihood is unknown. The flaw is not currently tracked in the CISA KEV catalog. Because the attacker must first be authenticated on the local network, the context is an adjacent attacker with network access. Once authenticated, the exploit is straightforward: upload or push a malicious VPN configuration file, causing the router to read and return the content of arbitrary files.