Command Injection Vulnerability in TP-Link AX53 v1
CVE-2025-15607

7.3HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Ax53 V1
Vendor
CVE Published:
20 March 2026

What is CVE-2025-15607?

A command injection vulnerability exists in the TP-Link AX53 v1 due to inadequate input validation in the mscd debug functionality. This flaw permits log redirection to arbitrary files and allows unauthorized commands to be executed through unvalidated input. An authenticated attacker can exploit this vulnerability to inject and execute malicious commands, which may result in complete control over the affected device, posing significant security risks.

Affected Version(s)

AX53 v1 0 < 251029

References

https://www.tp-link.com/en/support/download/archer-ax53/v...
patch
https://www.tp-link.com/us/support/faq/5025/
vendor-advisory

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

samuzora
.