CVE-2026-30816

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30816", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-03-05T17:35:52.174Z", "datePublished": "2026-04-08T17:53:20.560Z", "dateUpdated": "2026-05-07T15:47:05.900Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-04-08T17:53:20.560Z"}, "title": "Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-15", "description": "CWE-15 External control of system or configuration setting", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-597", "descriptions": [{"lang": "en", "value": "CAPEC-597 Absolute Path Traversal"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "AX53 v1.0", "modules": ["openvpn"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.1 Build 20260213", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An external control of configuration vulnerability in the OpenVPN module\u00a0of TP-Link AX53 v1.0\u00a0allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.\u00a0\nSuccessful\nexploitation may allow unauthorized access to arbitrary files on the device,\npotentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "An external control of configuration vulnerability in the OpenVPN module&nbsp;of TP-Link AX53 v1.0&nbsp;allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.&nbsp;\nSuccessful\nexploitation may allow unauthorized access to arbitrary files on the device,\npotentially exposing sensitive information.<p>This issue affects AX53 v1.0: before 1.7.1 Build 20260213.</p>"}]}], "references": [{"url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://talosintelligence.com/vulnerability_reports/", "tags": ["third-party-advisory"]}, {"url": "https://www.tp-link.com/us/support/faq/5055/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.8, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Lilith >_> of Cisco Talos", "type": "reporter"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0-beta"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T19:10:48.309522Z", "id": "CVE-2026-30816", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:21:56.624Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2304"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-07T15:47:05.900Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2304"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-05-07T15:47:05.900Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30816", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:10:48.309522Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T19:10:57.236Z"}}], "cna": {"title": "Arbitrary File Reading Vulnerability in OpenVPN Module in TP-Link AX53", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Lilith >_> of Cisco Talos"}], "impacts": [{"capecId": "CAPEC-597", "descriptions": [{"lang": "en", "value": "CAPEC-597 Absolute Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "modules": ["openvpn"], "product": "AX53 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.7.1 Build 20260213", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware", "tags": ["patch"]}, {"url": "https://talosintelligence.com/vulnerability_reports/", "tags": ["third-party-advisory"]}, {"url": "https://www.tp-link.com/us/support/faq/5055/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.0-beta"}, "descriptions": [{"lang": "en", "value": "An external control of configuration vulnerability in the OpenVPN module\u00a0of TP-Link AX53 v1.0\u00a0allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.\u00a0\nSuccessful\nexploitation may allow unauthorized access to arbitrary files on the device,\npotentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213.", "supportingMedia": [{"type": "text/html", "value": "An external control of configuration vulnerability in the OpenVPN module&nbsp;of TP-Link AX53 v1.0&nbsp;allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.&nbsp;\nSuccessful\nexploitation may allow unauthorized access to arbitrary files on the device,\npotentially exposing sensitive information.<p>This issue affects AX53 v1.0: before 1.7.1 Build 20260213.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-15", "description": "CWE-15 External control of system or configuration setting"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-04-08T17:53:20.560Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30816", "state": "PUBLISHED", "dateUpdated": "2026-05-07T15:47:05.900Z", "dateReserved": "2026-03-05T17:35:52.174Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-04-08T17:53:20.560Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["openvpn"], "product": "AX53 v1.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.7.1 Build 20260213", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_ax53_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "BBAE4118-799E-4ADB-9088-1CB86B54C09B", "versionEndIncluding": "1.7.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_ax53:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "5F3EA1D9-EB47-4785-9CF0-F2B51945917D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An external control of configuration vulnerability in the OpenVPN module\u00a0of TP-Link AX53 v1.0\u00a0allows an authenticated adjacent attacker to read arbitrary file when a malicious configuration file is processed.\u00a0\nSuccessful\nexploitation may allow unauthorized access to arbitrary files on the device,\npotentially exposing sensitive information.This issue affects AX53 v1.0: before 1.7.1 Build 20260213."}, {"lang": "es", "value": "Una vulnerabilidad de control externo de configuraci\u00f3n en el m\u00f3dulo OpenVPN de TP-Link AX53 v1.0 permite a un atacante adyacente autenticado leer un archivo arbitrario cuando se procesa un archivo de configuraci\u00f3n malicioso. La explotaci\u00f3n exitosa puede permitir el acceso no autorizado a archivos arbitrarios en el dispositivo, exponiendo potencialmente informaci\u00f3n sensible. Este problema afecta a AX53 v1.0: antes de 1.7.1 Build 20260213."}], "id": "CVE-2026-30816", "lastModified": "2026-07-25T11:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30816", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T19:10:48.309522Z", "version": "2.0.3"}}]}, "published": "2026-04-08T19:25:20.477", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Third Party Advisory"], "url": "https://talosintelligence.com/vulnerability_reports/"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/5055/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2304"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-15"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-610"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.7.1 Build 20260213)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "AX53 v1.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "ax53_v1", "vendor": "tp-link"}], "analysis": {"en": {"generated_at": "2026-04-14T17:47:52.413772+00:00", "value": {"mitigation_remediation": ["Upgrade the router firmware to version 1.7.1 Build 20260213 or later, which removes the vulnerable OpenVPN configuration handling.", "If an upgrade is not immediately possible, restrict access to the router\u2019s management interface and deny local network hosts from configuring OpenVPN.", "Disable the OpenVPN service entirely if it is not needed, removing the attack surface."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized read of arbitrary files"}, "threat_synthesis": {"affected_systems": "TP\u2011Link Systems Inc. router Archer AX53, firmware version 1.0, before the release of firmware 1.7.1 Build 20260213. Devices running any earlier firmware are potentially affected.", "description_and_impact": "An external control of configuration vulnerability in the OpenVPN module allows an authenticated adjacent attacker to supply a malicious configuration file that the router processes. When processed, the module can read any file on the device, exposing sensitive data. The flaw stems from improper validation of configuration inputs (CWE\u201115 and CWE\u2011610), enabling information disclosure without execution of arbitrary code.", "risk_and_exploitability": "The CVSS score is 6.8, indicating a moderate severity. The EPSS score is below 1\u202f%, suggesting a low likelihood of exploitation currently. The vulnerability is not listed in CISA\u2019s KEV catalogue. Because the attack requires an attacker to be authenticated on an adjacent network segment, adjacent local\u2011network access is a prerequisite. If such access is achieved, the attacker can read arbitrary files and compromise confidentiality."}}}}, "created": "2026-04-08T19:38:51.561402+00:00", "updated": "2026-04-15T16:15:11.927466+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$ax53_v1"]}