SB2026031746 - Multiple vulnerabilities in Tp-Link AX53

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026031746

SB2026031746 - Multiple vulnerabilities in Tp-Link AX53

Published: March 17, 2026

Security Bulletin ID SB2026031746
Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 secuirty vulnerabilities.


1) Heap-based buffer overflow (CVE-ID: CVE-2025-62405)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer SmartNetSetClientList() functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Heap-based buffer overflow (CVE-ID: CVE-2025-58077)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode 0x437 functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Heap-based buffer overflow (CVE-ID: CVE-2025-61983)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode 0x442 functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Heap-based buffer overflow (CVE-ID: CVE-2025-61944)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode 0xe01 functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Heap-based buffer overflow (CVE-ID: CVE-2025-59487)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode 0x441 functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


6) Key Exchange without Entity Authentication (CVE-ID: CVE-2025-62501)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the SSH Hostkey misconfiguration issue in the SSH Hostkey functionality. A remote user on the local network can perform a man-in-the-middle (MitM) attack to obtain device credentials and gain access if captured credentials are reused.


7) Heap-based buffer overflow (CVE-ID: CVE-2025-62404)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode 0x643 functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


8) Heap-based buffer overflow (CVE-ID: CVE-2025-59482)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode 0x411 functionality. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


9) Heap-based buffer overflow (CVE-ID: CVE-2025-62673)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tdpServer ssh port update functionality. A remote user on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


10) Heap-based buffer overflow (CVE-ID: CVE-2025-58455)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the tmpServer opcode. A remote administrator on the local network can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References