CVE-2026-5511CWE-209

Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72

Medium · published May 19, 2026

CVSS v4.0
4.6
EPSS
0%
Percentile
18.8
In the wild
Unconfirmed
What it is

In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command usage information.

An authenticated attacker with administrative privileges could exploit this issue to confirm the presence of the diagnostic utility and view its valid command-line syntax and options.  The exposed information is limited in scope and does not include sensitive system data.

The record
Technical detail
CVSS v4.0
4.6 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00274 · 18.8th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-05-19T15:58Z
EPSS history
Timeline
  • 19 MAY 15:58Z
    Information Disclosure via Diagnostic Interface Due to Improper Input Validation on TP-Link's Archer AX72
    cvelistv5