CVE-2025-58077
Published: 03 February 2026
Summary
CVE-2025-58077 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Tp-Link Archer Ax53 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Applying vendor firmware updates directly remediates the heap-based buffer overflow in the tmpserver modules as specified in the TP-Link advisory.
Validating the number and structure of host entries in incoming network packets prevents the excessive data that triggers the heap buffer overflow.
Memory protection mechanisms like heap isolation or randomization mitigate exploitation of the heap-based buffer overflow for arbitrary code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in router network service enables remote code execution from low-priv authenticated access on adjacent network, directly mapping to exploitation of remote services and privilege escalation.
NVD Description
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted set of network packets containing an excessive number of host entries…
more
This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.
Deeper analysisAI
CVE-2025-58077 is a heap-based buffer overflow vulnerability (CWE-122) in the tmpserver modules of the TP-Link Archer AX53 v1.0 router firmware. It affects versions through 1.3.1 Build 20241120 and has a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw arises when processing a specially crafted set of network packets containing an excessive number of host entries, leading to potential memory corruption.
Authenticated attackers on the adjacent network (AV:A, PR:L) can exploit this vulnerability by sending the malicious packets to the affected device. Successful exploitation may cause a segmentation fault, resulting in a denial of service, or potentially allow arbitrary code execution with high confidentiality, integrity, and availability impacts.
Mitigation details are available in the Talos Intelligence advisory (TALOS-2025-2294) and TP-Link support resources. Vendor firmware updates for Archer AX53 v1.0 are provided on regional download pages, such as those for the US and Malaysia, along with a relevant FAQ (faq/4943) outlining patch deployment. Security practitioners should apply these updates promptly to affected devices.
Details
- CWE(s)