Is CVE-2026-30816 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30816 being exploited in the wild.

How severe is CVE-2026-30816?

Medium severity, with a CVSS score of 5.7, published 8 April 2026.

Which products and versions are affected?

TP-Link Archer Ax53 before 1.7.1 Build 20260213.

Is there a fix for CVE-2026-30816?

A patch was published on 2026-02-13: Firmware build 20260213 released to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30816 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-30816?

Check whether you run TP-Link Archer Ax53 or TP-Link Archer Ax53 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30816: TP-Link Archer AX53 arbitrary file read in OpenVPN module

CVE-2026-30816 · Severity: medium · CVSS 5.7 · Published 2026-04-08

A security vulnerability exists in the TP-Link Archer AX53 router, a device used to provide wireless internet and secure remote access. An attacker already on the local network could exploit the router's VPN configuration process to read private files stored on the device. This could lead to the exposure of sensitive system information or configuration data.

Technologies: TP-Link Archer Ax53, TP-Link Archer Ax53 Firmware. Vendors: TP-Link.

Quick answers

Is CVE-2026-30816 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30816 being exploited in the wild.
How severe is CVE-2026-30816?: Medium severity, with a CVSS score of 5.7, published 8 April 2026.
Which products and versions are affected?: TP-Link Archer Ax53 before 1.7.1 Build 20260213.
Is there a fix for CVE-2026-30816?: A patch was published on 2026-02-13: Firmware build 20260213 released to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30816 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-30816?: Check whether you run TP-Link Archer Ax53 or TP-Link Archer Ax53 Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An external control of configuration vulnerability (CWE-15/CWE-610) exists in the OpenVPN module of the TP-Link Archer AX53 v1.0 router. The flaw is triggered during the processing of a malicious OpenVPN configuration file, specifically related to how the device handles external resource references. An authenticated attacker located on the adjacent network (LAN) can exploit this to perform arbitrary file disclosure, potentially accessing sensitive system files. The vulnerability is addressed in firmware version 1.7.1 Build 20260213 and later.

Affected products

TP-Link Archer AX53 v1.0 before 1.7.1 Build 20260213

Timeline

2026-02-13: patched: Firmware build 20260213 released to address the issue.
2026-04-08: disclosed: Initial disclosure by TP-Link.
2026-05-07: advisory: Detailed advisory published by Cisco Talos.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.