TP-Link published a security advisory for the Archer AX55 on 3 September 2026. It names two flaws, CVE-2026-18167 and CVE-2026-18330, and a single firmware build that fixes both. Most coverage stops at the CVE numbers, yet the useful detail sits in the scope lines. Only one hardware revision is covered, and the more serious of the two bugs cannot be reached at all unless you switched a particular feature on. This article explains who the Archer AX55 security advisory actually applies to, what each flaw lets an attacker do, and the exact firmware string that clears your router.
What TP-Link published
The advisory covers the Archer AX55 in hardware version 4. TP-Link lists two issues.
CVE-2026-18167 is a stack-based buffer overflow in the EasyMesh module, rated 7.7 and marked High. TP-Link describes an attacker on the local network submitting crafted input that causes the easymesh daemon to crash, and says the attacker may potentially achieve remote code execution on the device.
CVE-2026-18330 is a hard-coded RSA-1024 key in the web login module, rated 6.1 and marked Medium. An attacker on the local network who captures HTTP login sessions could use that key to decrypt the administrator password.
Both are fixed in firmware 1.2.1 Build 20260527.
Hardware version is not a detail you can skip
Routers sold under one model name often go through several silent hardware revisions. The Archer AX55 has done exactly that, and this advisory names version 4 only. So the first job is not downloading anything. It is turning the router over.
The printed label on the underside carries a version string next to the model name, written as Ver followed by a number. If yours reads 4.0 or another 4.x figure, the advisory applies to you. If it reads 1.x, 2.x or 3.x, this particular pair of flaws is not the one to chase. Download firmware for the wrong hardware version and the router will refuse it in the best case, so match the string before you fetch anything.
The EasyMesh flaw needs mesh mode switched on
This is the part worth reading twice. TP-Link scopes CVE-2026-18167 to the EasyMesh module when mesh mode is enabled. The vulnerable code runs in a daemon that only does work once the router is participating in a mesh.
The Archer AX55 supports two different mesh schemes, and buyers often enable one so a compatible extender can join later without replacing the router. That flexibility is a genuine strength of the model, and our specification page for the TP-Link Archer AX55 lists it among the reasons the router punches above its price. Yet it is also the switch that decides whether this flaw is theoretical or live on your network.
If you run the AX55 alone, with mesh turned off, you are not exposed to the buffer overflow. Patch anyway, because the second flaw does not care about that setting.
What a hard-coded key really costs you
The second flaw is quieter and easier to misread. A hard-coded key means every unit of that firmware shares the same secret, baked into the image rather than generated per device. Anyone who extracts it from one router holds it for all of them.
Here that key protects the login exchange in the web interface. So an attacker who can watch traffic on your local network, capture a login session, and apply the key ends up with your administrator password in clear text. That password is usually the one that opens the whole router, and plenty of people reuse it elsewhere.
The rating of 6.1 reflects the local-network requirement rather than the value of the prize. A guest on your Wi-Fi, a compromised laptop, or an untrusted smart device on the same subnet all count as attackers here.
Neither flaw arrives from the internet
Both entries describe an attacker on the LAN. That is a real limit, and it should calm anyone imagining a scan sweeping the internet for vulnerable AX55 units. Still, it is not a reason to wait. Home networks routinely carry devices you did not audit, and a device that already misbehaves is precisely the foothold these flaws reward.
The fix shipped before the notice
The fixed build carries the date 20260527, which reads as 27 May 2026. The advisory went up on 3 September 2026. Vendors commonly ship a fix first and publish once it has been distributed, so a router that has taken updates recently may already be clear.
Check the running firmware in the router's administration page and compare it against 1.2.1 Build 20260527. Anything older needs the update. TP-Link distributes it through its own support download centre, and you should take the file from there rather than from a mirror.
What to do this week
Start with the label, because everything else depends on the hardware version. Then read your current firmware string and update if it falls short of the fixed build. After the router reboots, change the administrator password, since the old one may have been exposed to anyone who captured a login on your network. Finally, look at whether mesh mode is on at all. If you enabled it years ago for an extender you no longer use, turning it off removes one attack surface for good.
