VulnSocial

CVE-2026-18167Patch

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-121

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 4 signals
  • Technical details provided in 5 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 3 mentions (2026-09-04); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-09-04: 3Mentions · 2026-09-05: 1Mentions · 2026-09-06: 1Patch / Workaround · 2026-09-04: 3Patch / Workaround · 2026-09-05: 1Technical Details · 2026-09-04: 3Technical Details · 2026-09-05: 1Technical Details · 2026-09-06: 109-0409-0509-06
Signal classification2 categories
Patch
360.0%
Disclosure
240.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-043
Disclosure1Patch2
2026-09-051
Patch1
2026-09-061
Disclosure1
Full discourse5 posts
  • elhacker.NET@elhackernet
    Disclosure

    Vulnerabilidades en TP-Link Archer permiten ejecución remota de código TP-Link ha revelado dos vulnerabilidades de seguridad ( CVE-2026-18167 y CVE-2026-18330 ) en su router Archer AX55 v4 https://blog.elhacker.net/2026/09/vulnerabilidades-en-tp-link-archer.html

    Post summary

    TP‑Link has disclosed two CVEs (CVE‑2026‑18167 and CVE‑2026‑18330) affecting the Archer AX55 v4 router that enable remote code execution; no PoC, exploit code, active exploitation, or mitigation details are provided.

    021267146.9K
    142.5K followersView on X
  • ThreatWire@ThreatWire_
    Disclosure

    🚨 HIGH: CVE-2026-18167 (CVSS 7.7) is a stack-based buffer overflow in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker can send crafted input to the EasyMesh daemon, potentially causing a crash or achieving remote code execution on the device. 🔴 Update to firmware 1.2.1 Build 20260527 or later. If updating is not immediately possible, disable Mesh mode. 🔗 http://tp-link.com/support/faq/5279/… #TPLink #ArcherAX55 #CVE #EasyMesh #RCE #CyberSecurity #Infosec

    Post summary

    The text announces CVE-2026-18167, a stack‑based buffer overflow in TP‑Link Archer AX55's EasyMesh module, and advises users to update firmware or disable Mesh mode to mitigate the risk.

    000801.4K
    1.7K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🚨 TP-Link Archer AX55 V4 routerlarda RCE riski! Routerdaki CVE-2026-18167 adlı EasyMesh açığı, aynı yerel ağdaki saldırganların özel hazırlanmış veriler göndererek cihaz üzerinde kod çalıştırmasına yol açabiliyor. CVE-2026-18330 ise HTTP üzerinden yapılan yönetici girişlerinin ele geçirilmesine ve admin parolasının çözülmesine neden olabiliyor. CVE-2026-18167 — CVSS 7.7 CVE-2026-18330 — CVSS 6.1 ✅ Çözüm: 1.2.1 Build 20260527 Türkiye'de de Archer AX55 V4 için resmi TP-Link destek ve firmware sayfası bulunuyor. TP-Link Türkiye sitesinde AX55'in V1, V2, V4 ve V4.60 donanım sürümleri ayrı olarak listeleniyor; ancak söz konusu güvenlik advisory'sinde etkilenen sürüm V4 olarak belirtiliyor. AX55 V4 kullanıcıları cihazlarının hardware version ve firmware sürümünü kontrol etmeli.

    Post summary

    TP‑Link announced CVE‑2026‑18167 and CVE‑2026‑18330 on Archer AX55 V4 routers, detailing RCE and admin login hijack risks, and supplied a firmware update (1.2.1 Build 20260527) to mitigate the vulnerabilities.

    00001272
    2.2K followersView on X
  • The CyberSec Guru@thecybersecguru
    Patch

    🚨 TP-Link Archer AX55 users: check your firmware now. Two vulnerabilities affect Archer AX55 V4: 🔴 CVE-2026-18167 — EasyMesh stack-based buffer overflow → potential RCE 🔴 CVE-2026-18330 — hardcoded RSA private key → admin credential theft ⚠️ Update to 1.2.1 Build 20260527. Full technical analysis + mitigation guide 👇 https://thecybersecguru.com/exploits/tp-link-archer-ax55-cve-2026-18167-cve-2026-18330/ Read the full Archer AX55 vulnerability analysis #CyberSecurity #InfoSec #CVE #TPLink #RouterSecurity #RCE #Vulnerability #CyberAttack #Networking

    Post summary

    The tweet alerts TP‑Link Archer AX55 users to two critical CVEs—one causing a stack-based buffer overflow and another exposing a hardcoded RSA key—and directs them to update to firmware 1.2.1 Build 20260527 to mitigate the risks.

    00000160
    1.5K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    A TP-Link Archer AX55 vulnerability (CVE-2026-18167) risks remote code execution via EasyMesh buffer overflow. Update to build 20260527 now. #TPLink #ArcherAX55 #RouterSecurity #CVE #BufferOverflow #NetworkSecurity #Infosec https://securityonline.info/tp-link-archer-ax55-vulnerability/ https://t.co/t8VInkuSll

    Post summary

    The tweet announces the discovery of CVE‑2026‑18167, describing a buffer overflow that enables remote code execution, and urges users to install the updated firmware build 20260527.

    00000426
    12.9K followersView on X

Explore more

Back to dashboard