What is CVE-2025-15607?

CVE-2025-15607 is a critical-severity vulnerability in Tp-link Archer_ax53, classified under Command Injection. CVSS score: 9.8/10. Published 2026-03-20.

How severe is CVE-2025-15607?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Tp-link Archer_ax53

CVE-2025-15607

A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling aut…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.020 (78.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Tp-link Archer_ax53
Tp-link Archer_ax53_firmware — versions 1.0
Tp-link Systems Inc. Ax53 V1 — versions 0

Weakness classification (CWE)

CWE-77 — Command Injection

References

f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2025-15607?: CVE-2025-15607 is a critical-severity vulnerability in Tp-link Archer_ax53, classified under Command Injection. CVSS score: 9.8/10. Published 2026-03-20.
How severe is CVE-2025-15607?: Critical severity. CVSS v3 base score is 9.8 out of 10.