Critical TP-Link Omada Flaws Let Attackers Remotely Control Devices

Key Takeaways

• Five critical vulnerabilities have been discovered in the TP-Link Archer AX53 v1.0 router.
• These flaws could enable remote attackers to execute commands, crash services, and steal sensitive data.
• The vulnerabilities impact key modules including OpenVPN, dnsmasq, and tmpServer.
• TP-Link has released firmware version 1.7.1 Build 20260213 to patch these issues, and immediate updates are strongly recommended.

Cybersecurity researchers have uncovered a series of five significant security vulnerabilities within the TP-Link Archer AX53 v1.0 router. These flaws present a substantial risk, potentially allowing unauthorized individuals to gain complete control over the affected device and the network it manages.

The identified vulnerabilities, assigned multiple CVE identifiers, are distributed across critical router components such as the OpenVPN, dnsmasq, and tmpServer modules. Exploitation of these weaknesses could enable attackers on the same network to execute arbitrary system commands, trigger device crashes, and exfiltrate sensitive configuration files, culminating in a full compromise of the router.

High-Severity Command Injection Flaws

Among the most severe findings are two OS command injection vulnerabilities, both rated with a high CVSS v4.0 score of 8.5. These include CVE-2026-30815, affecting the OpenVPN module, and CVE-2026-30818, which impacts the dnsmasq module. Both stem from inadequate input validation when the router processes configuration files.

An authenticated attacker with local network access can exploit these vulnerabilities by uploading a specially crafted configuration file. This action allows them to execute arbitrary system commands, enabling modifications to device settings, exposure of confidential data, and ultimately, full control over the router’s operating system.

Another significant flaw, CVE-2026-30814, carries a CVSS score of 7.3. This vulnerability is a stack-based buffer overflow located in the router’s tmpServer module. An attacker on the adjacent network can trigger a segmentation fault by supplying a malicious configuration file, which crashes the service and opens a pathway for arbitrary code execution. Such code execution can destabilize the device, manipulate its functions, and establish a persistent presence on the network hardware.

The remaining two vulnerabilities, CVE-2026-30816 (OpenVPN module) and CVE-2026-30817 (dnsmasq module), are rated with a medium CVSS v4.0 score of 6.8. These flaws expose sensitive data through arbitrary file reading capabilities. They permit an attacker to bypass existing security restrictions and access private files stored on the device. While not granting direct control, this exposure can reveal critical administrative credentials, passwords, and network configurations, which can then be leveraged for subsequent attacks.

These vulnerabilities specifically target the TP-Link Archer AX53 v1.0 router, a Wi-Fi 6 device widely deployed internationally, though not marketed in the United States. TP-Link has officially acknowledged and addressed these security deficiencies in their latest firmware release. All versions prior to 1.7.1 Build 20260213 are affected.

What You Should Do

• Immediately update your TP-Link Archer AX53 v1.0 router to firmware version 1.7.1 Build 20260213 or newer.
• Download the updated firmware directly from your region’s official TP-Link support portal.
• Verify that your router’s firmware is indeed updated after the installation process.
• Regularly check for and apply firmware updates for all network devices to maintain optimal security.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.