Which versions of TP-Link are affected by CVE-2025-15517?

CVE-2025-15517 presents significant security risk, a missing authentication vulnerability rated CVSS 8.6.. A patch is available.

How to fix or mitigate CVE-2025-15517?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

TP-Link CVE-2025-15517

Q: What is the CVSS score of CVE-2025-15517?

CVE-2025-15517 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208937 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-23 TPLink

GHSA-vfwf-qwpx-47fh

Authentication Bypass TP-Link

8.6

CVSS 4.0

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:15 euvd

EUVD-2025-208937

Analysis Generated

Mar 23, 2026 - 18:15 vuln.today

Patch released

Mar 23, 2026 - 18:15 nvd

Patch available

CVE Published

Mar 23, 2026 - 18:01 nvd

HIGH 8.6

DescriptionNVD

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

AnalysisAI

A missing authentication check in the HTTP server of TP-Link Archer NX-series routers (NX200, NX210, NX500, NX600) allows unauthenticated attackers to access privileged CGI endpoints intended for authenticated administrators. An attacker can perform critical operations including firmware upload and configuration changes without providing valid credentials, effectively gaining administrative control over the device. A vendor patch is available, and this vulnerability represents a direct authentication bypass with severe real-world exploitation potential.

Technical ContextAI

The vulnerability exists in the HTTP server implementation of TP-Link Archer NX-series wireless routers, classified as CWE-306 (Missing Authentication Check). The affected devices include Archer NX200 (versions 2.0, 2.20, 3.0), Archer NX210 (versions 2.0/2.20, 3.0), Archer NX500 (versions 1.0, 2.0), and Archer NX600 (versions 1.0, 2.0, 3.0) as identified via CPE strings (cpe:2.3:a:tp-link_systems_inc.:archer_nx*). The root cause is insufficient access control logic in CGI endpoint handlers, allowing HTTP requests to reach sensitive administrative functions without first validating session tokens or credentials. This is a network-accessible vulnerability in the router's embedded web server that fails to enforce authentication middleware before processing requests to firmware upload and configuration management endpoints.

RemediationAI

Immediately download and install the latest firmware for your specific Archer NX-series router model from the TP-Link support pages (https://www.tp-link.com/en/support/download/) for your device (NX200, NX210, NX500, or NX600). Each product line has dedicated firmware updates that address the authentication bypass. Until patching is complete, implement the following mitigations: disable remote management of the router's web interface (restrict access to the web UI to only local network addresses via firewall rules), change the default admin credentials to a strong password, and if possible, place the router behind an additional network firewall that restricts inbound HTTP/HTTPS traffic to trusted administrative sources only. For enterprises managing multiple Archer NX devices, establish a patch management schedule and verify successful updates by checking the firmware version in the router's administration panel after reboot. Refer to the official advisory at https://www.tp-link.com/us/support/faq/5027/ for device-specific patching instructions.