CVE-2025-15517
Received Received - Intake
Authentication Bypass in TP-Link Archer HTTP Server Enables Privileged Access

Publication date: 2026-03-23

Last updated on: 2026-03-31

Assigner: TPLink

Description
A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-23
Last Modified
2026-03-31
Generated
2026-06-16
AI Q&A
2026-03-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-15517
EUVD
EUVD-2025-208937
Affected Vendors & Products
Showing 7 associated CPEs
Vendor Product Version / Range
tp-link archer_nx600_firmware to 1.3.0 (exc)
tp-link archer_nx500_firmware to 1.5.0 (exc)
tp-link archer_nx210_firmware to 1.3.0 (exc)
tp-link archer_nx200_firmware to 1.3.0 (exc)
tp-link archer_nx600_firmware to 1.4.0 (exc)
tp-link archer_nx500_firmware to 1.3.0 (exc)
tp-link archer_nx200_firmware to 1.8.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is caused by a missing authentication check in the HTTP server of certain TP-Link Archer router models (NX200, NX210, NX500, and NX600). It allows an attacker to access specific cgi endpoints without needing to authenticate.

Because of this, an attacker can perform privileged HTTP actions that are normally restricted to authenticated users, such as uploading firmware or changing configuration settings.

Impact Analysis

This vulnerability can have serious impacts because it allows unauthorized users to perform high-privilege actions on affected routers.

  • An attacker could upload malicious firmware, potentially taking full control of the device.
  • Configuration settings could be altered without permission, leading to network disruptions or security weaknesses.
  • Overall, it compromises the security and integrity of the affected network devices.
Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15517. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart