# CVE-2026-30814: TP-Link Archer AX53 stack overflow in tmpServer

Source: https://junglewise.ai/threats/cve-2026-30814-tp-link-archer-ax53-stack-overflow-in-tmpserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-30814 · Severity: high · CVSS 8 · Published 2026-04-08

A security vulnerability exists in the TP-Link Archer AX53 v1.0 router, a device used for home and small office networking. An authenticated attacker on the same local network can exploit this flaw by uploading a malicious configuration file. If successful, this could allow the attacker to crash the device or take full control of it, potentially leading to the theft of sensitive data or unauthorized monitoring of network traffic.

Technologies: [TP-Link Archer Ax53](https://junglewise.ai/threats/technologies/archer-ax53), [TP-Link Archer Ax53 Firmware](https://junglewise.ai/threats/technologies/archer-ax53-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-30814 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30814 being exploited in the wild.

**How severe is CVE-2026-30814?** High severity, with a CVSS score of 8, published 8 April 2026.

**Which products and versions are affected?** TP-Link Archer Ax53 before 1.7.1 Build 20260213.

**Is there a fix for CVE-2026-30814?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-30814 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-30814?** Check whether you run TP-Link Archer Ax53 or TP-Link Archer Ax53 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the tmpServer module of the TP-Link Archer AX53 v1.0 router. The vulnerability is triggered during the processing of a specially crafted configuration file, specifically involving opcode 0x436. An attacker must be authenticated and located on the adjacent network (local network) to exploit this flaw. Successful exploitation allows for arbitrary code execution with high privileges on the device, which can lead to a complete compromise of device integrity, confidentiality, and availability. The issue is resolved in firmware version 1.7.1 Build 20260213 and later.

## Affected products

- TP-Link Archer AX53 v1.0 before 1.7.1 Build 20260213

## Timeline

- 2026-04-08: disclosed: Initial disclosure by TP-Link
- 2026-04-08: advisory: NVD publication date
- 2026-05-07: advisory: Cisco Talos advisory publication

## References

- [https://talosintelligence.com/vulnerability_reports/](https://talosintelligence.com/vulnerability_reports/)
- [https://www.tp-link.com/en/support/download/archer-ax53/v1/](https://www.tp-link.com/en/support/download/archer-ax53/v1/)
- [https://www.tp-link.com/my/support/download/archer-ax53/v1/](https://www.tp-link.com/my/support/download/archer-ax53/v1/)
- [https://www.tp-link.com/us/support/faq/5055/](https://www.tp-link.com/us/support/faq/5055/)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2302](https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2302)

## Related threats

- [TP-Link Archer AX53 OS command injection in dnsmasq](https://junglewise.ai/threats/cve-2026-30818-tp-link-archer-ax53-os-command-injection-in-dnsmasq)
- [TP-Link Archer AX53 arbitrary file read in OpenVPN module](https://junglewise.ai/threats/cve-2026-30817-tp-link-archer-ax53-arbitrary-file-read-in-openvpn-module)
- [TP-Link Archer AX53 arbitrary file read in OpenVPN module](https://junglewise.ai/threats/cve-2026-30816-tp-link-archer-ax53-arbitrary-file-read-in-openvpn-module)
- [TP-Link Archer AX53 OS command injection in OpenVPN module](https://junglewise.ai/threats/cve-2026-30815-tp-link-archer-ax53-os-command-injection-in-openvpn-module)
- [TP-Link Archer AX53 and AX55 stack overflow in tdpServer](https://junglewise.ai/threats/cve-2025-15608-tp-link-archer-ax53-and-ax55-stack-overflow-in-tdpserver)