Two significant security vulnerabilities have been identified in TP-Link’s Archer AX55 v4 routers, potentially allowing attackers within the local network to crash services, steal admin credentials, and execute remote code. These vulnerabilities pose a notable risk to users, necessitating immediate attention and action.
Details of the Vulnerabilities
The vulnerabilities, labeled CVE-2026-18167 and CVE-2026-18330, impact the EasyMesh and web login modules of the Archer AX55 model, hardware version V4. TP-Link has responded by releasing firmware version 1.2.1 Build 20260527 to mitigate these issues. The company issued an advisory on September 3, 2026, urging users to update their devices.
Impact of CVE-2026-18167
The primary concern, CVE-2026-18167, involves a stack-based buffer overflow within the EasyMesh component. This vulnerability, which has been assigned a CVSS v4 score of 7.7, is considered highly severe. EasyMesh facilitates the integration of networking devices into a unified mesh Wi-Fi network. The flaw is exploitable when Mesh mode is activated on the affected routers.
Attackers connected to a vulnerable network can send crafted inputs to the easymesh daemon, potentially causing the service to crash. More critically, this flaw may allow attackers to execute arbitrary code on the router, compromising the device that bridges local systems and the internet. Such a breach could lead to unauthorized monitoring of network traffic, alteration of DNS settings, and further network attacks.
Insights into CVE-2026-18330
The second vulnerability, CVE-2026-18330, affects the web login module and stems from a hardcoded RSA-1024 private key within the product. This vulnerability, rated with a CVSS v4 score of 6.1, allows local attackers to decrypt admin passwords if they capture an HTTP-based login session. The use of a weak AES session key further exacerbates the risk by facilitating the compromise of session confidentiality.
This vulnerability highlights the dangers of using unencrypted HTTP for administrative access. Attackers on the same network can exploit these weaknesses, particularly on unsecured or shared Wi-Fi networks, to gain control over router settings.
Recommendations and Mitigation Strategies
TP-Link advises users of the Archer AX55 V4 to promptly update to firmware version 1.2.1 Build 20260527 to protect against these vulnerabilities. Additional precautions include disabling Mesh mode when unnecessary, avoiding HTTP for router management, using strong and unique admin passwords, and preventing exposure of management access to untrusted networks.
By implementing these measures, users can safeguard their network devices against potential intrusions and maintain the integrity and security of their local networks.
