Security Advisory on L2TP over IPSec Encryption Failure on Archer AXE75 (CVE-2026-0620)

Vulnerability Description:

When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled.

Impact:

This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality.

CVSS v4.0 Score: 6 / Medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Download and update to the latest firmware version to fix the vulnerabilities.

US: Download for Archer AXE75 | TP-Link

EN: Download for Archer AXE75 | TP-Link

2. Ensure IPSec is enforced after updating.

Disclaimer:

If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.