Security Advisory on L2TP over IPSec Encryption Failure on Archer AXE75 (CVE-2026-0620)
87 Vulnerability Description:
When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled.
Impact:
This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality.
CVSS v4.0 Score: 6 / Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Products/Versions and Fixes:
|
Affected Product Model |
Related Vulnerabilities |
Affected Version |
|
Archer AXE75 V1 |
CVE-2026-0620 |
<1.5.1 Build 20251202 |
Recommendations:
We strongly recommend that users with affected devices take the following actions:
- Download and update to the latest firmware version to fix the vulnerabilities.
US: Download for Archer AXE75 | TP-Link
EN: Download for Archer AXE75 | TP-Link
- Ensure IPSec is enforced after updating.
Disclaimer:
If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.
Is this faq useful?
Your feedback helps improve this site.
TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.