CVE-2025-61944
Published: 03 February 2026
Summary
CVE-2025-61944 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Tp-Link Archer Ax53 Firmware. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-61944 is a heap-based buffer overflow vulnerability (CWE-122) in the tmpserver modules of the TP-Link Archer AX53 v1.0 router. It affects versions through 1.3.1 Build 20241120 and has a CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw arises when processing a specially crafted network packet containing an excessive number of fields with zero-length values, leading to potential memory corruption.
Authenticated attackers on the adjacent network (AV:A) with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation may cause a segmentation fault, resulting in a denial of service, or potentially allow arbitrary code execution with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation details are available in vendor advisories and reports. TP-Link provides updated firmware for the Archer AX53 v1.0 on regional support download pages, such as those for the US and Malaysia. Talos Intelligence's vulnerability report TALOS-2025-2288 offers technical analysis, and a related FAQ on TP-Link's site addresses firmware updates. Security practitioners should apply the latest firmware to vulnerable devices.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206689
Vulnerability details
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing an excessive number of fields with zero‑length values.This…
more
issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in router network service (tmpserver) directly enables remote exploitation for code execution or DoS via crafted packets.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the heap-based buffer overflow by applying vendor-provided firmware updates to the affected TP-Link Archer AX53 router.
Requires validation of incoming network packets to reject those with excessive numbers of zero-length fields, preventing the buffer overflow in tmpserver modules.
Implements heap memory protections such as bounds checking and safe unlinking to mitigate exploitation of the buffer overflow even if invalid packets are processed.