TP-Link has released security updates for two vulnerabilities found in its Archer AX55 v4 wireless router. These vulnerabilities could allow attackers on the local network to crash a key networking service, potentially execute code, or steal administrator credentials from captured login traffic.
The vulnerabilities, identified as CVE-2026-18167 and CVE-2026-18330, impact the router’s EasyMesh component and web-based login module.
TP-Link published the advisory on September 3, 2026, urging affected users to update to firmware version 1.2.1 Build 20260527.
TP-Link Archer AX55 Flaws
CVE-2026-18167 is a stack-based buffer overflow in the EasyMesh module of Archer AX55 devices, hardware version 4. This vulnerability can be exploited when Mesh mode is enabled.
According to TP-Link, an attacker on the same local area network can submit specially crafted input to the vulnerable EasyMesh service. If successfully exploited, this can cause the easymesh daemon to crash and may allow remote code execution on the router.
Compromising the router can have serious consequences as it manages traffic between connected devices and the internet. An attacker with code execution capabilities could alter network settings, monitor traffic, change DNS configurations, establish persistence, or use the router as a platform for further attacks.
TP-Link assigned this flaw a CVSS v4.0 score of 7.7, classifying it as High severity. While the attack requires adjacent network access and has high attack complexity, it does not require authentication or user interaction. The vulnerability threatens the confidentiality, integrity, and availability of the affected device.
The second issue, CVE-2026-18330, involves a hardcoded shared RSA-1024 private key in the Archer AX55 v4 web login module. This vulnerability could allow a local network attacker to decrypt an administrator password after capturing an HTTP login session.
TP-Link indicated that the known shared RSA private key can be used to decrypt password data transmitted during login.
Additionally, a weakened AES session key further diminishes the protection expected from encrypted authentication exchanges. Stolen administrator credentials could provide an attacker with full control over the router’s configuration interface.
CVE-2026-18330 has a CVSS v4.0 score of 6.1 and is classified as Medium severity. This vulnerability has low attack complexity, requires no privileges or user interaction, and primarily threatens confidentiality.
Affected Version and Fixes
These vulnerabilities affect TP-Link Archer AX55 routers with hardware version V4. The company has addressed both issues in the following update:
| Product | Hardware Version | Fixed Firmware |
|---|---|---|
| Archer AX55 | V4 | 1.2.1 Build 20260527 |
Users are encouraged to download and install the latest firmware from TP-Link’s official Archer AX55 V4 firmware page.
Additionally, organizations and home users should turn off unnecessary HTTP-based router administration, use HTTPS where available, restrict management access to trusted devices, and monitor connected clients for unusual activity.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
