How severe is CVE-2025-15608?

CVE-2025-15608 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-15608 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-15608?

CVE-2025-15608 affects Tp-link Archer Ax53 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-15608?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-15608 have an EU (EUVD) identifier?

Yes. CVE-2025-15608 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-208907.

When was CVE-2025-15608 published?

CVE-2025-15608 was published on 2026-03-20 and last updated on 2026-06-17.

CVE-2025-15608

CVE-2025-15608 is a critical-severity vulnerability in Tp-link Archer Ax53 Firmware with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-121.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 7.7
EPSS exploit prediction: 1% (41st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-208907
Weakness: CWE-121
Affected product: Tp-link Archer Ax53 Firmware
Published: 2026-03-20
Last modified: 2026-06-17

Description

This vulnerability in AX53 v1 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.

Frequently asked questions

What is CVE-2025-15608?: This vulnerability in AX53 v1 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.
How severe is CVE-2025-15608?: CVE-2025-15608 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-15608 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (41st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-15608?: CVE-2025-15608 affects Tp-link Archer Ax53 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-15608?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-15608 have an EU (EUVD) identifier?: Yes. CVE-2025-15608 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-208907.
When was CVE-2025-15608 published?: CVE-2025-15608 was published on 2026-03-20 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*

More vulnerabilities in Tp-link Archer Ax53 Firmware

CVE-2025-15607 — Critical (CVSS 9.8): A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling,…
CVE-2026-0834 — High (CVSS 8.8): Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows…
CVE-2025-62501 — High (CVSS 8.1): SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain…
CVE-2026-30818 — High (CVSS 8.0): An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated…
CVE-2026-30815 — High (CVSS 8.0): An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated…
CVE-2026-30814 — High (CVSS 8.0): A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent…

All CVEs affecting Tp-link Archer Ax53 Firmware →

Other CWE-121 (Stack-based Buffer Overflow) vulnerabilities

CVE-2026-12848 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12847 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12846 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-12485 — Critical (CVSS 10.0): GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and…
CVE-2026-37541 — Critical (CVSS 10.0): Buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) 3.3.005. In canformat_gvret.cpp, the length…
CVE-2026-42996 — Critical (CVSS 10.0): JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of…

Browse all CWE-121 (Stack-based Buffer Overflow) vulnerabilities →