Loading story…
TP-Link disclosed two vulnerabilities in Archer AX55 V4 routers. High-severity CVE-2026-18167 is a stack-based buffer overflow in EasyMesh that a local-network attacker can exploit, when Mesh mode is enabled, to crash the EasyMesh daemon and potentially execute code on the router. Medium-severity CVE-2026-18330 affects the web-login module, which uses a hardcoded shared RSA-1024 private key and weak AES session-key handling.
An attacker able to capture an HTTP administrator-login session on the local network could use CVE-2026-18330 to decrypt the router administrator password. TP-Link remediated both flaws in firmware 1.2.1 Build 20260527 and advised affected users to update promptly, avoid HTTP-based administration, and disable Mesh mode if it is not required.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
TP-Link released firmware version 1.2.1 Build 20260527 to remediate CVE-2026-18167 and CVE-2026-18330 in Archer AX55 hardware version V4 routers.
TP-Link disclosed CVE-2026-18167, a high-severity EasyMesh stack buffer overflow that may enable code execution for a local-network attacker when Mesh mode is enabled, and CVE-2026-18330, a web-login cryptographic weakness that can expose captured HTTP administrator credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link has disclosed and patched a high-severity authenticated command injection flaw, **CVE-2026-5509**, affecting **Archer BE450 v1** and **BE7200 v1** routers. The vulnerability in the web management interface carries a **CVSS 8.5** score and can let an attacker who has already gained administrative access execute arbitrary system commands, potentially leading to elevated privileges, configuration tampering, unauthorized service execution, and interception of sensitive network traffic. TP-Link said devices running firmware earlier than **`1.3.0 Build 20260416`** are vulnerable and urged customers to install the latest firmware from its regional support portals. The disclosure follows broader reporting on security weaknesses affecting **TP-Link Archer NX** routers, adding to concerns over exploitable flaws in the vendor’s consumer networking lineup. Together, the reports highlight continued risk in internet-facing router management functions, where compromised credentials or prior access can turn web interface bugs into full device compromise. Organizations and home users using affected Archer models should verify firmware versions, restrict administrative access, and apply vendor updates immediately.
Jun 29, 2026
TP-Link Archer AX53 v1.0 routers were found to contain two high-severity OS command injection vulnerabilities, tracked as **`CVE-2026-30815`** and **`CVE-2026-30818`**, affecting the device's OpenVPN and dnsmasq modules. In both cases, an authenticated attacker on an adjacent network can supply a specially crafted configuration file to trigger arbitrary command execution because of insufficient input validation, a weakness classified as **`CWE-78`**. Successful exploitation could let an attacker alter router configuration, access sensitive information, and undermine overall device integrity and availability. The flaws affect Archer AX53 v1.0 firmware releases prior to **`1.7.1 Build 20260213`**, and the CVSS v4.0 assessments indicate low attack complexity under adjacent-network conditions with high impact across confidentiality, integrity, and availability.
Jun 29, 2026
TP-Link released firmware updates for **Archer NX200, NX210, NX500, and NX600** routers to address multiple high-severity vulnerabilities, including **`CVE-2025-15517`**, an authentication bypass issue that could let an unauthenticated attacker upload malicious firmware and carry out privileged configuration changes. The flaws affect the Archer NX product line and prompted TP-Link to urge customers to install the latest firmware immediately. The updates also fix **`CVE-2025-15605`**, a **hardcoded cryptographic key** weakness mapped to **`CWE-321`**. That flaw allows an authenticated attacker to decrypt router configuration files, alter them, and re-encrypt them, compromising the confidentiality and integrity of stored settings. Reporting on the patches comes amid broader scrutiny of TP-Link devices, including prior CISA action on other TP-Link router vulnerabilities and wider regulatory attention on foreign-made consumer networking equipment.
Jun 29, 2026