# CVE-2025-15608: TP-Link Archer AX53 and AX55 stack overflow in tdpServer

Source: https://junglewise.ai/threats/cve-2025-15608-tp-link-archer-ax53-and-ax55-stack-overflow-in-tdpserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-20. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2025-15608 · Severity: critical · CVSS 9.8 · Published 2026-03-20

A vulnerability exists in several TP-Link Archer router models that could allow an attacker to remotely crash the device or potentially take full control of it. These routers are commonly used to provide internet connectivity and manage home or small business networks. If exploited, an attacker could disrupt internet service or gain unauthorized access to the device's management functions and network traffic.

Technologies: [TP-Link Archer AX55](https://junglewise.ai/threats/technologies/archer-ax55), [TP-Link Archer Ax53](https://junglewise.ai/threats/technologies/archer-ax53), [TP-Link Archer Ax53 Firmware](https://junglewise.ai/threats/technologies/archer-ax53-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2025-15608 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15608 being exploited in the wild.

**How severe is CVE-2025-15608?** Critical severity, with a CVSS score of 9.8, published 20 March 2026.

**Which products and versions are affected?** TP-Link Archer AX55 before (US)_V4_251030; TP-Link Archer Ax53 before 251029.

**Is there a fix for CVE-2025-15608?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-15608 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2025-15608?** Check whether you run TP-Link Archer AX55, TP-Link Archer Ax53 or TP-Link Archer Ax53 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the 'tdpServer' module of TP-Link Archer AX53 v1, AX55 v4, and AX55 v4.6 routers. The flaw is caused by insufficient input sanitization within the device's probe handling logic when processing unvalidated parameters. A remote, unauthenticated attacker can exploit this by sending specially crafted packets to trigger the overflow. Successful exploitation can lead to a service crash (Denial of Service) or, through complex heap-spray techniques, remote code execution. Firmware updates are available to address this issue.

## Affected products

- TP-Link Archer AX53 v1 before 251029
- TP-Link Archer AX55 v4 before (US)_V4_251030
- TP-Link Archer AX55 v4.6 before (US)_V4.6_251030

## Timeline

- 2026-03-20: disclosed
- 2026-03-20: advisory

## References

- [https://www.tp-link.com/en/support/download/archer-ax53/v1/](https://www.tp-link.com/en/support/download/archer-ax53/v1/)
- [https://www.tp-link.com/en/support/download/archer-ax55/v4/](https://www.tp-link.com/en/support/download/archer-ax55/v4/)
- [https://www.tp-link.com/us/support/download/archer-ax55/v4.60/](https://www.tp-link.com/us/support/download/archer-ax55/v4.60/)
- [https://www.tp-link.com/us/support/download/archer-ax55/v4/](https://www.tp-link.com/us/support/download/archer-ax55/v4/)
- [https://www.tp-link.com/us/support/faq/5025/](https://www.tp-link.com/us/support/faq/5025/)

## Related threats

- [TP-Link Archer AX55 hard-coded RSA key in web login](https://junglewise.ai/threats/cve-2026-18330-tp-link-archer-ax55-hard-coded-rsa-key-in-web-login)
- [TP-Link Archer AX55 stack-based buffer overflow in EasyMesh](https://junglewise.ai/threats/cve-2026-18167-tp-link-archer-ax55-stack-based-buffer-overflow-in-easymesh)
- [TP-Link Archer AX53 OS command injection in dnsmasq](https://junglewise.ai/threats/cve-2026-30818-tp-link-archer-ax53-os-command-injection-in-dnsmasq)
- [TP-Link Archer AX53 arbitrary file read in OpenVPN module](https://junglewise.ai/threats/cve-2026-30817-tp-link-archer-ax53-arbitrary-file-read-in-openvpn-module)
- [TP-Link Archer AX53 arbitrary file read in OpenVPN module](https://junglewise.ai/threats/cve-2026-30816-tp-link-archer-ax53-arbitrary-file-read-in-openvpn-module)