DEV Community

Shubham Chaudhary
Shubham Chaudhary

Posted on

TP-Link Archer AX55 (V4): CVE-2026-18167 & CVE-2026-18330 Explained

#security #networking #infosec #devops

If you're running a TP-Link Archer AX55 (Hardware V4) in your home lab, remote office, or client network — patch it today.

TP-Link disclosed two vulnerabilities on Sept 3, 2026:

🔴 CVE-2026-18167 — CVSS 7.7 (High)

Stack-based buffer overflow in the EasyMesh daemon. Exploitable only when Mesh mode is enabled. Impact ranges from DoS to potential RCE.

🟠 CVE-2026-18330 — CVSS 6.1 (Medium)

Hardcoded RSA-1024 private key in the web login module. Admins managing the router over HTTP (not HTTPS) risk having captured sessions decrypted to reveal the admin password.

Threat model: Both require local/adjacent-network access — not internet-facing. Still relevant given guest Wi-Fi, IoT devices, and shared networks.

Quick exposure check 

nmap -sV -p 80,443 192.168.1.1
Enter fullscreen mode Exit fullscreen mode

If port 80 responds with a login page and 443 doesn't, you're managing over HTTP — fix that.

Fix checklist

  • Update to firmware 1.2.1 Build 20260527
  • Disable Mesh mode if unused
  • Enforce HTTPS for admin panel
  • Rotate admin password post-update
  • Segment IoT/guest traffic from LAN

Full technical breakdown + attack chain walkthrough:
👉 https://www.xpert4cyber.com/2026/09/tp-link-archer-ax55-vulnerability-admin-access.html

Top comments (0)