# CVE-2026-30815: TP-Link Archer AX53 OS command injection in OpenVPN module

Source: https://junglewise.ai/threats/cve-2026-30815-tp-link-archer-ax53-os-command-injection-in-openvpn-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-30815 · Severity: high · CVSS 8 · Published 2026-04-08

A security vulnerability exists in the TP-Link Archer AX53 router, a device used to provide Wi-Fi and networking for homes and small offices. An attacker already on the local network could take control of the device by uploading a malicious configuration file to the VPN settings. This could lead to the theft of sensitive data, modification of network settings, or a complete takeover of the router.

Technologies: [TP-Link Archer Ax53](https://junglewise.ai/threats/technologies/archer-ax53), [TP-Link Archer Ax53 Firmware](https://junglewise.ai/threats/technologies/archer-ax53-firmware). Vendors: [TP-Link](https://junglewise.ai/threats/vendors/tp-link).

## Quick answers

**Is CVE-2026-30815 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30815 being exploited in the wild.

**How severe is CVE-2026-30815?** High severity, with a CVSS score of 8, published 8 April 2026.

**Which products and versions are affected?** TP-Link Archer Ax53 before 1.7.1 Build 20260213.

**Is there a fix for CVE-2026-30815?** A patch was published on 2026-02-13: Firmware build date for the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30815 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-30815?** Check whether you run TP-Link Archer Ax53 or TP-Link Archer Ax53 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in the OpenVPN module of the TP-Link Archer AX53 v1.0 router. The flaw is caused by insufficient input validation when processing OpenVPN configuration files during a configuration restore process. Specifically, parameters such as 'client_connect', 'script_security', 'client_disconnect', and 'route_up' can be manipulated to execute arbitrary system commands. An attacker must be authenticated and located on the adjacent network to exploit this vulnerability. Successful exploitation allows for full system compromise, including the ability to modify configuration files and disclose sensitive information. The issue is resolved in firmware version 1.7.1 Build 20260213.

## Affected products

- TP-Link Archer AX53 v1.0 before 1.7.1 Build 20260213

## Timeline

- 2026-04-08: disclosed
- 2026-04-08: advisory
- 2026-02-13: patched: Firmware build date for the fix

## References

- [https://talosintelligence.com/vulnerability_reports/](https://talosintelligence.com/vulnerability_reports/)
- [https://www.tp-link.com/en/support/download/archer-ax53/v1/](https://www.tp-link.com/en/support/download/archer-ax53/v1/)
- [https://www.tp-link.com/my/support/download/archer-ax53/v1/](https://www.tp-link.com/my/support/download/archer-ax53/v1/)
- [https://www.tp-link.com/us/support/faq/5055/](https://www.tp-link.com/us/support/faq/5055/)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2303](https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2303)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2307](https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2307)
- [https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2308](https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2308)

## Related threats

- [TP-Link Archer AX53 OS command injection in dnsmasq](https://junglewise.ai/threats/cve-2026-30818-tp-link-archer-ax53-os-command-injection-in-dnsmasq)
- [TP-Link Archer AX53 arbitrary file read in OpenVPN module](https://junglewise.ai/threats/cve-2026-30817-tp-link-archer-ax53-arbitrary-file-read-in-openvpn-module)
- [TP-Link Archer AX53 arbitrary file read in OpenVPN module](https://junglewise.ai/threats/cve-2026-30816-tp-link-archer-ax53-arbitrary-file-read-in-openvpn-module)
- [TP-Link Archer AX53 stack overflow in tmpServer](https://junglewise.ai/threats/cve-2026-30814-tp-link-archer-ax53-stack-overflow-in-tmpserver)
- [TP-Link Archer AX53 and AX55 stack overflow in tdpServer](https://junglewise.ai/threats/cve-2025-15608-tp-link-archer-ax53-and-ax55-stack-overflow-in-tdpserver)