CVE-2026-18167— Stack-based buffer overflow in TP-Link Archer AX55 v4
Quick assessment
Affected
TP-Link Systems Inc. Archer AX55 v4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TP-Link Archer AX55 v4 的 EasyMesh 模块存在栈溢出漏洞。当启用 Mesh 模式时，局域网攻击者可通过提交特制的输入，导致 easymesh 守护进程崩溃，并可能实现远程代码执行。 成功利用该漏洞时，在启用 Mesh 模式的情况下，可能导致 EasyMesh 守护进程崩溃，并可能允许远程代码执行。这可能会对受影响设备的机密性、完整性和可用性造成高影响。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18167
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stack-based buffer overflow in TP-Link Archer AX55 v4
Source: CVE Program / CVE List V5
Vulnerability Description
A
stack-based buffer overflow vulnerability exists in the EasyMesh module of
TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit
crafted input that causes the easymesh daemon to crash and may potentially
achieve remote code execution on the device.
Successful
exploitation may cause the EasyMesh daemon to crash and may potentially allow
remote code execution when Mesh mode is enabled. This
may result in high impact to the confidentiality, integrity, and availability
of the affected device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Archer AX55 v4 | 0 ~ 1.2.1 Build 20260527 | - |
|
II. Public POCs for CVE-2026-18167
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18167
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18167 (1)
Vendor Pages for CVE-2026-18167 (1)
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-18330
Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 -
CVE-2026-75118
http_gdpr_decrypt Pre-Authentication Stack-Based Buffer Over -
CVE-2026-76784
Insufficient Cryptographic Protections in Local Device Commu -
CVE-2026-78541
Command Injection in Parent Control of TP-Link Archer BE3600 -
CVE-2026-16348
Command Injection Vulnerability in VPN connection of Archer
V. Comments for CVE-2026-18167
No comments yet