Loading vulnerability…
OS Command Injection in TP-Link Archer AX53 dnsmasq Module
CVE-2026-30818 is an OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0. The flaw is caused by insufficient input validation when the device processes a specially crafted configuration file. An authenticated attacker on an adjacent network can exploit this condition to inject and execute arbitrary operating system commands in the context of the affected device. The issue affects TP-Link Archer AX53 v1.0 firmware versions prior to 1.7.1 Build 20260213.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code or command execution on the router. As a result, an attacker may modify device configuration, access sensitive information handled or stored by the device, and further compromise overall system integrity. Given the stated impact to confidentiality, integrity, and availability, exploitation could also enable broader device takeover or service disruption depending on execution context.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict administrative access to the router to trusted hosts only, minimize adjacent-network exposure, and prevent untrusted users from supplying or importing configuration files. Monitor for unauthorized configuration changes and suspicious administrative activity. Segmentation of management access and disabling unnecessary administrative pathways may reduce exposure until the firmware update can be applied.
Patch, then assume compromise.
Upgrade TP-Link Archer AX53 v1.0 to firmware version 1.7.1 Build 20260213 or later, as versions before this release are affected. Apply the vendor-provided fixed firmware from TP-Link support channels and verify that the device is running the updated build after installation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.