CVE-2025-15517
Authentication Bypass in TP-Link Archer HTTP Server Enables Privileged Access
Publication date: 2026-03-23
Last updated on: 2026-03-31
Assigner: TPLink
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tp-link | archer_nx600_firmware | to 1.3.0 (exc) |
| tp-link | archer_nx500_firmware | to 1.5.0 (exc) |
| tp-link | archer_nx210_firmware | to 1.3.0 (exc) |
| tp-link | archer_nx200_firmware | to 1.3.0 (exc) |
| tp-link | archer_nx600_firmware | to 1.4.0 (exc) |
| tp-link | archer_nx500_firmware | to 1.3.0 (exc) |
| tp-link | archer_nx200_firmware | to 1.8.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by a missing authentication check in the HTTP server of certain TP-Link Archer router models (NX200, NX210, NX500, and NX600). It allows an attacker to access specific cgi endpoints without needing to authenticate.
Because of this, an attacker can perform privileged HTTP actions that are normally restricted to authenticated users, such as uploading firmware or changing configuration settings.
How can this vulnerability impact me? :
This vulnerability can have serious impacts because it allows unauthorized users to perform high-privilege actions on affected routers.
- An attacker could upload malicious firmware, potentially taking full control of the device.
- Configuration settings could be altered without permission, leading to network disruptions or security weaknesses.
- Overall, it compromises the security and integrity of the affected network devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know