CVE-2025-15608
Published: 20 March 2026
Description
This vulnerability in AX53 v1 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code…
more
execution through complex heap-spray techniques. Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the insufficient input sanitization in probe handling logic by requiring validation and sanitization of untrusted inputs to prevent stack-based buffer overflows.
Requires timely application of firmware updates provided by TP-Link to remediate the known buffer overflow flaw in the Archer AX53 v1 router.
Implements memory protection mechanisms such as stack canaries or address space layout randomization to mitigate exploitation of stack-based buffer overflows even if input validation fails.
Security SummaryAI
CVE-2025-15608 is a stack-based buffer overflow vulnerability (CWE-121) affecting the TP-Link Archer AX53 v1 router. It arises from insufficient input sanitization in the device's probe handling logic, where unvalidated parameters can trigger the overflow, causing the affected service to crash. Published on 2026-03-20, the vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation typically results in repeated service unavailability through denial-of-service crashes, and under specific conditions, may enable remote code execution via complex heap-spray techniques, potentially allowing attackers to gain control of the device.
TP-Link mitigation guidance includes firmware updates for the Archer AX53 v1, available at https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware, along with additional details in FAQ 5025 at https://www.tp-link.com/us/support/faq/5025/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-15608 is a buffer overflow in a public-facing router service (T1190: Exploit Public-Facing Application), enabling unauthenticated remote DoS crashes and potential RCE; DoS via application exploitation matches T1499.004.