Security Advisory on Multiple Vulnerabilities on TP-Link Archer NX200, NX210, NX500 and NX600 (CVE-2025-15517 to CVE-2025-15519 and CVE-2025-15605)

Description of Vulnerabilities and Impacts:

CVE-2025-15517: Authorization Bypass in HTTP Server Endpoints

A missing authentication check in the HTTP server to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

CVSS v4.0 Score: 8.6/ High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVE-2026-15518: Command Injection Vulnerability in Wireless Control CLI Path &

CVE-2026-15519: Command Injection Vulnerability in Modem Management CLI Path

Improper input handling in an administrative CLI command allows crafted input to be executed as part of an OS command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting confidentiality, integrity and availability of the device.

CVSS v4.0 Score: 8.5 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVE-2025-15605: Hardcoded Cryptographic Key in Configuration Encryption Mechanism

A hardcoded cryptographic key within its configuration mechanism enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them and re-encrypt them, affecting confidentiality and integrity of device configuration data.

CVSS v4.0 Score: 8.5 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Download and update to the latest firmware version to fix the vulnerabilities.

Download for Archer NX200 | TP-Link

Download for Archer NX210 | TP-Link

Download for Archer NX500 | TP-Link

Download for Archer NX600 | TP-Link

Note: The products mentioned in this security advisory are not sold in the US.

Disclaimer:

If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.