Critical TP-Link Archer AX55 Vulnerabilities Expose Routers to RCE and Credential Theft: Full Technical Analysis and Patch Guide

Key Takeaways:

• Affected Device: TP-Link Archer AX55 (Hardware Version V4 only).
• Vulnerabilities: CVE-2026-18167 (stack-based buffer overflow in EasyMesh leading to RCE) and CVE-2026-18330 (hardcoded RSA-1024 private key in the web login module).
• Severity: High (7.7) and Medium (6.1) CVSS v4 scores.
• Resolution: Update to firmware version 1.2.1 Build 20260527 now.

TP-Link has disclosed two vulnerabilities in its Archer AX55 Wi-Fi 6 router, and they only affect hardware version V4. Discovered in late August and published in an advisory on September 3, 2026, the flaws let an attacker on the local network crash critical services, intercept administrative credentials, and ultimately achieve remote code execution.

The attack requires local network access, which sounds limiting until you consider where these routers actually sit: enterprise environments, shared workspaces, and networks with a few compromised IoT devices already on them. A router that’s been taken over is a choke point for every packet that crosses it. From there, an attacker can pivot to other devices, read unencrypted traffic, or rewrite DNS. Below is a technical breakdown of both flaws and a hardening guide for home users and network administrators.

Technical Deep Dive: CVE-2026-18167 (EasyMesh RCE)

The more serious of the two, CVE-2026-18167, carries a CVSS v4 score of 7.7 (High). It’s a stack-based buffer overflow in the easymesh daemon, the background service that negotiates and maintains TP-Link’s proprietary mesh networking topology.

The mechanics of the overflow

Daemons like easymesh typically run as root on embedded router hardware, since they need to manage low-level radio interfaces and network bridging. The bug is that the daemon processes incoming mesh negotiation packets without checking payload length properly.

Send a specially crafted, oversized packet to the EasyMesh service from anywhere on the local network, and the excess data overruns the allocated stack buffer. On the ARM-based Qualcomm chipsets that power the Archer AX55, that overflow lets an attacker overwrite the saved return address, whether that’s the link register or the stack frame pointer. Align the payload carefully and you can redirect execution to injected shellcode, or chain together return-oriented programming gadgets to get around NX protections.

Exploitation constraints and impact

Two conditions have to hold for exploitation to work: the attacker needs Layer 2 (local network) access, and EasyMesh mode has to be enabled on the router. Worst case without RCE is denial of service: the daemon crashes and mesh nodes drop. With RCE, an attacker gets root on the router’s Linux-based OS, and from there they can sniff internal traffic, plant a persistent backdoor, or turn the router into a launchpad against everything else on the LAN.

Technical Deep Dive: CVE-2026-18330 (Cryptographic and Authentication Failures)

CVE-2026-18330 (CVSS v4 score 6.1, Medium) is a cryptographic implementation failure in the router’s web admin portal, a compound issue involving hardcoded keys, outdated algorithms, and weak session handling.

The danger of hardcoded RSA-1024 keys

The Archer AX55’s web interface tries to protect admin credentials in transit by encrypting the login payload. The problem is that TP-Link hardcoded a static RSA-1024 private key directly into the firmware binary.

RSA-1024 is already obsolete on its own, vulnerable to factorization via the General Number Field Sieve. But hardcoding the private key is the bigger mistake. Firmware binaries are public, so anyone can pull that key out in minutes. An attacker watching the local network can then capture the HTTP login request and use the extracted key to decrypt the admin password in plain text. The encryption might as well not be there.

Weak AES session keys and HTTP exposure

TP-Link’s implementation also uses a weak AES session key, most likely from poor entropy in the router’s PRNG during session initialization, which cuts the effort needed to brute-force the symmetric key if someone gets past the RSA layer. The admin interface also runs over unencrypted HTTP instead of enforcing HTTPS with HSTS, so the whole session is open to passive eavesdropping. On a shared Wi-Fi network, Wireshark or Bettercap can grab these sessions with no real effort, letting an attacker hijack the admin panel without ever cracking a password.

What happens after compromise

Router compromises rarely stop at the router. Once an attacker has RCE through the EasyMesh flaw, or admin access through the cryptographic flaw, they control the network’s edge, and DNS hijacking is usually the next move: point the router’s DNS at attacker-controlled servers, and users get quietly redirected to phishing pages built to look like their bank or email provider.

A compromised router can also strip TLS from internal traffic, scan the local subnet for IoT devices that never get patched, and hold open a reverse shell back to a command-and-control server. Because the router is a trusted device on the network, moving past the firewall from there is trivial.

Mitigation and Hardening Guide

TP-Link has released firmware version 1.2.1 Build 20260527, which patches both CVEs. Patching alone won’t fully secure the network, though. Here’s a tiered approach for the Archer AX55.

Step 1: Verify hardware version and apply the patch

Flash the wrong firmware and you’ll brick the device. The Archer AX55 has several hardware revisions, and this vulnerability only affects V4.

1. Log into the router’s web interface, usually at 192.168.0.1 or tplinkwifi.net.
2. Go to Advanced > System > Firmware Upgrade.
3. Check the hardware version listed at the top of the page. Confirm it says V4.
4. Download the 1.2.1 Build 20260527 firmware from TP-Link’s official support portal. Skip third-party firmware repositories entirely.
5. Upload the file and let the router reboot on its own. Don’t cut power during the process.

Step 2: Reduce the attack surface

A vulnerable service that isn’t running can’t be exploited.

• Disable EasyMesh if you’re running the Archer AX55 as a standalone router rather than in a mesh topology with other TP-Link nodes. This neutralizes CVE-2026-18167 entirely.
• Disable Remote Management. WAN-side access to the admin panel should be off. Administration should only work from the local LAN.

Step 3: Network-level hardening

To cut the risk that comes from local-network attack requirements and HTTP-based admin access:

• Use a strong admin password. Replace the default with a unique passphrase of at least 16 characters. This limits the damage of session hijacking, since the attacker still has to decrypt a much stronger credential.
• Segment the network. Use the Guest Network feature or VLAN tagging, if it’s supported, to keep untrusted IoT devices and smart home gear off the same segment as your primary devices. A compromised IoT device shouldn’t have Layer 2 access to the router’s management interface.
• Force HTTPS for management if the updated firmware supports it. That stops passive eavesdropping on session cookies and credentials over the local network.

Final thoughts

These two disclosures are another data point in a pattern we keep seeing: edge devices are prime targets, and hardcoded cryptographic keys and memory-unsafe C code still turn up in networking gear that ships to millions of homes. It’s the gap between how fast consumer hardware gets built and how carefully its security gets engineered.

For home users, the firmware update plus disabling unused mesh features covers the risk. For enterprise administrators running consumer-grade hardware in branch offices, this is one more argument for business-grade routing equipment with audited cryptographic implementations and centralized management.