CVE-2025-15607 is a command injection in the mscd debug function of the TP-Link Archer AX53 v1 router. NVD scores it 9.8, while TP-Link rates it 7.3 High and says it needs an authenticated attacker. Update to firmware 251029 or later.
What's affected
TP-Link's advisory covers the Archer AX53 version 1 for this CVE. The affected firmware is anything older than build 251029. The AX53 is not sold in the United States, so US owners are less likely to have one.
The advisory describes the flaw as an authenticated command injection in the mscd service. Debug functionality allows log output to be redirected to arbitrary files, and the content of those files is then joined into shell commands without validation. The vendor says successful exploitation could lead to full control of the device.
A note on the score. The NVD record lists 9.8 with a network vector and no privileges. TP-Link's own CVSS v4.0 score is 7.3 High, with an adjacent network vector and high privileges required. Both agree on the impact if exploited. The difference is in who can reach the code, which is why the vendor says authentication is required. The companion issue CVE-2025-15608 affects the same router and the AX55.
How to check if you're exposed
Find the hardware version printed on the router's label, then the firmware build in the admin page under system or firmware information. Compare:
- Archer AX53 v1: fixed in firmware 251029 or later.
TP-Link links a help article on how to find the hardware version. If your device is a different hardware version, this advisory does not list it as affected.
Check also who has access to the router's admin page. The flaw needs authentication, so a weak or default admin password makes it easier. Look at the list of admin accounts and the remote management setting, and turn off remote management if you do not use it.
What to do now
- Identify AX53 routers by model and hardware version.
- Download firmware 251029 or later from TP-Link's support page for the AX53 and install it.
- Set a strong, unique admin password and turn off remote administration.
- Restrict the admin page to a trusted device or wired connection where the router allows it.
- Reboot and confirm the new firmware version in the admin page.
Why it matters
The record lists CWE-77, Command Injection. Debug features are a classic risk in embedded devices because they accept file paths and strings the main interface would never accept. Here, content written to a file is later read back into a shell command without cleaning it, so whoever controls the file controls the command.
Home routers sit at the edge of every device behind them, so control of one gives a position to watch or redirect traffic. The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog, and the advisory says nothing of attacks in the wild.
Quick check
Why do NVD and TP-Link give different scores?
NVD lists 9.8 using a network vector with no privileges. TP-Link scores it 7.3 with an adjacent vector and high privileges required, reflecting that an authenticated attacker is needed.
Does this affect the AX55?
Not for this CVE. TP-Link lists the AX53 v1 for CVE-2025-15607. CVE-2025-15608 covers the AX55 as well.
Sources
Last reviewed: 19 October 2026.
