CVE-2025-40634
Critical
Description
Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 router, in firmware versions prior to 1.0.15 build 241203 rel61480. This vulnerability allows an attacker to execute arbitrary code on the device over LAN and WAN networks.
SeverityCritical
CVSS9.2
Exploit probability—
Product
Link Archer AX50
PublishedMay 20, 2025
First seenMay 20, 2025
Weakness typeCWE-121CWE-121
How to fix
Update
- TP-Link Link Archer AX501.0.15 build 241203 rel61480 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Link Archer AX50 | v < 1.0.15 build 241203 rel61480 | 1.0.15 build 241203 rel61480 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.