TP-LINK has disclosed two vulnerabilities affecting the Archer AX55 v4 router. The flaws involve the EasyMesh service and the web login module, with one issue potentially enabling remote code execution and the other exposing the admin password to a local attacker. The affected product is the Archer AX55 v4, including hardware version 1.2.1 and earlier builds.
Details from the advisory name two CVEs: CVE-2026-18167, a stack-based buffer overflow in the EasyMesh component (severity 7.7 CVSS v4), and CVE-2026-18330, a hardcoded RSA-1024 private key in the web login module (severity 6.1). TP-Link notes that the buffer overflow can occur when Mesh mode is enabled and may allow a LAN attacker to cause the easymesh daemon to crash, potentially leading to remote code execution.
The second flaw allows decryption of the admin password if an attacker captures an HTTP login session, aided by a weakened AES session key. Both issues have been fixed in firmware build 1.2.1 Build 20260527; users of older firmware remain at risk. At present, there is no public PoC or confirmed exploitation, and the advisory urges updating to the patched build to mitigate risk.