Security Advisory on Authenticated Command injection Vulnerability in Archer MR600 (CVE-2025-14756)

Vulnerability Description:

Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a limited character length via crafted input in the browser developer console.

Impact:

The vulnerability allows an authenticated attacker to inject system commands via the admin interface, leading to service disruption or full compromise.

CVSS v4.0 Score: 8.5 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Download and update to the latest firmware version to fix the vulnerabilities.

EN: Download for Archer MR600 | TP-Link

JP: Archer MR600 のコンテンツ | TP-Link 日本

This product is not sold in the US.

Disclaimer:

If you do not take all of the recommended actions, this vulnerability concern will remain. TP-Link cannot bear any responsibility for the consequences that could have been avoided by following the recommended actions in this advisory.