CVE-2025-62405
Published: 03 February 2026
Summary
CVE-2025-62405 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Tp-Link Archer Ax53 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 1.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces bounds checking and validation of network packet fields to prevent heap buffer overflows from oversized length values in tmpserver modules.
Requires timely remediation of the specific flaw through application of vendor firmware patches addressing the improper bounds checking.
Implements memory protections like heap isolation and non-executable regions to mitigate potential arbitrary code execution from heap overflows.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in network service (tmpserver) enables remote exploitation of the router for code execution (T1210) from adjacent authenticated access, with potential privilege escalation to root/admin on the device (T1068).
NVD Description
Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault or potentially execute arbitrary code via a specially crafted network packet containing a field whose length exceeds the maximum expected…
more
value.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.
Deeper analysisAI
CVE-2025-62405 is a heap-based buffer overflow vulnerability (CWE-122) in the tmpserver modules of TP-Link Archer AX53 v1.0 routers. It affects versions through 1.3.1 Build 20241120. The flaw arises when processing a specially crafted network packet containing a field whose length exceeds the maximum expected value, leading to improper bounds checking.
Authenticated adjacent attackers can exploit this vulnerability with low complexity, requiring only low privileges and no user interaction. By sending the malicious packet over the local network, they can trigger a segmentation fault or potentially achieve arbitrary code execution, granting high confidentiality, integrity, and availability impacts as scored by CVSS 3.1 at 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Mitigation is addressed in vendor advisories and firmware updates available from TP-Link support pages for Archer AX53 v1.0, including downloads specific to various regions. Detailed analysis is provided in Talos Intelligence reports, such as TALOS-2025-2284, recommending immediate application of patched firmware to affected devices.
Details
- CWE(s)