CVE-2025-15545
Unknown Unknown - Not Provided
Command Injection in Backup Restore Function Allows Root Execution

Publication date: 2026-01-29

Last updated on: 2026-03-09

Assigner: TPLink

Description
The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Successful exploitation allows the attacker to gain root-level command execution, compromising confidentiality, integrity and availability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-03-09
Generated
2026-06-16
AI Q&A
2026-01-29
EPSS Evaluated
2026-06-14
NVD
CVE-2025-15545
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tp-link archer_re605x_firmware to 1.2.10 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability allows an attacker to gain root-level command execution, compromising the confidentiality, integrity, and availability of the device. Such a compromise can lead to unauthorized access to sensitive data and disruption of services, which may result in non-compliance with common standards and regulations like GDPR and HIPAA that require protection of data confidentiality and integrity as well as system availability. [1]

Executive Summary

The vulnerability in the TP-Link Archer RE605X router's backup restore function occurs because it does not properly validate unexpected or unrecognized tags within the backup file. When a specially crafted backup file containing malicious tags is restored, these tags are interpreted by the device's shell, allowing an attacker to execute arbitrary commands with root privileges. This means an attacker can gain full control over the device by exploiting this flaw. [1]

Impact Analysis

Exploitation of this vulnerability allows an attacker to execute commands with root privileges on the affected device. This compromises the device's confidentiality, integrity, and availability, potentially leading to unauthorized access, data theft, device malfunction, or complete takeover of the device. [1]

Mitigation Strategies

To mitigate this vulnerability, you should immediately update your TP-Link Archer RE605X router firmware to the latest versions: EU_V3_20260113 or US_V3_20260126 or later. This update addresses the backup restore function vulnerability by properly validating backup file tags and preventing arbitrary command execution. Avoid restoring backup files from untrusted sources and ensure only authorized users have access to the device. Do not use third-party firmware as it is not supported and may void your warranty. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart