Multiple TP-Link Archer Vulnerabilities Allow Attackers to Execute Remote Code

TP-Link disclosed two vulnerabilities in the Archer AX55 v4 router: CVE-2026-18167, a High-severity stack-based buffer overflow in the EasyMesh daemon that can crash the service and may allow code execution when Mesh mode is enabled; and CVE-2026-18330, a Medium-severity issue where a hardcoded RSA-1024 private key and weak AES session key can expose HTTP-based administrator credentials. TP-Link released firmware 1.2.1 Build 20260527 to address both issues and recommends updating, disabling Mesh mode when not needed, avoiding HTTP for management, and using strong unique admin passwords.