CVE-2025-15608 is a stack based buffer overflow in the probe handling of TP-Link Archer AX53 v1, AX55 v4 and AX55 v4.6 routers. NVD scores it 9.8, TP-Link rates it 7.7 High. Update to AX53 firmware 251029 or AX55 build 1.2.1 20260527 or later.
What's affected
TP-Link's advisory lists these affected devices and fixes:
- Archer AX53 v1: firmware older than 251029. Fixed in 251029 or later.
- Archer AX55 v4: US firmware older than 1.2.1 Build 20260527. Fixed at that build or later.
- Archer AX55 v4.6: US firmware older than 1.2.1 Build 20260527. Fixed at that build or later.
The flaw is in the network probe handling function. Insufficient checking of parameters can trigger a stack based buffer overflow, which crashes the service. The vendor says repeated crashes cause service unavailability and, under specific conditions, may allow remote code execution through complex heap spray techniques.
The NVD record scores it 9.8 on a network vector. TP-Link's own CVSS v4.0 score is 7.7 High with an adjacent network vector and high attack complexity. The sibling issue is CVE-2025-15607, which affects only the AX53 v1.
How to check if you're exposed
Check the hardware version on the router label, then the firmware in the admin page.
- If it is an AX53 v1, you need firmware 251029 or later.
- If it is an AX55 v4 or v4.6 sold in the US, you need 1.2.1 Build 20260527 or later.
- Other hardware versions are not listed in this advisory.
TP-Link provides download pages for each model and a help article on finding the hardware version. If the router's admin page offers automatic updates, check that they are on. If a router crashes or restarts without reason, record when and treat it as a reason to update at once.
What to do now
- Identify AX53 and AX55 routers and their hardware versions.
- Install the fixed firmware from TP-Link's download pages for your model and region.
- Turn on automatic firmware updates if the router offers them.
- Disable remote administration and any service you do not use, to shrink what can be reached.
- Replace the device if TP-Link stops issuing updates for it in the future.
Why it matters
The record lists CWE-121, Stack-based Buffer Overflow. The probe handler copies input into a fixed size memory area on the stack without checking its length, so oversized or malformed values write past the end. The first visible result is a crash. With skill and the right conditions, writing past the buffer can redirect execution.
The vendor's wording is careful: crashing is the common result and code execution is possible only in certain scenarios, using techniques it calls complex. The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog. Patching is still the right call, because routers rarely have other defenses.
Quick check
Which firmware fixes the AX55?
TP-Link lists the AX55 v4 and v4.6 as fixed at US firmware 1.2.1 Build 20260527 or later.
Is remote code execution likely?
The vendor says it is possible only under specific conditions and with complex techniques. Crashes and loss of service are the more likely outcome.
Sources
Last reviewed: 19 October 2026.
