EUVD-2025-208937
GHSA-vfwf-qwpx-47fh
CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Description
A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.
Analysis
A missing authentication check in the HTTP server of TP-Link Archer NX-series routers (NX200, NX210, NX500, NX600) allows unauthenticated attackers to access privileged CGI endpoints intended for authenticated administrators. An attacker can perform critical operations including firmware upload and configuration changes without providing valid credentials, effectively gaining administrative control over the device. A vendor patch is available, and this vulnerability represents a direct authentication bypass with severe real-world exploitation potential.
Technical Context
The vulnerability exists in the HTTP server implementation of TP-Link Archer NX-series wireless routers, classified as CWE-306 (Missing Authentication Check). The affected devices include Archer NX200 (versions 2.0, 2.20, 3.0), Archer NX210 (versions 2.0/2.20, 3.0), Archer NX500 (versions 1.0, 2.0), and Archer NX600 (versions 1.0, 2.0, 3.0) as identified via CPE strings (cpe:2.3:a:tp-link_systems_inc.:archer_nx*). The root cause is insufficient access control logic in CGI endpoint handlers, allowing HTTP requests to reach sensitive administrative functions without first validating session tokens or credentials. This is a network-accessible vulnerability in the router's embedded web server that fails to enforce authentication middleware before processing requests to firmware upload and configuration management endpoints.
Affected Products
TP-Link Archer NX200 versions 2.0, 2.20, and 3.0; TP-Link Archer NX210 versions 2.0/2.20 and 3.0; TP-Link Archer NX500 versions 1.0 and 2.0; and TP-Link Archer NX600 versions 1.0, 2.0, and 3.0 are all affected. These devices are identified via CPE strings cpe:2.3:a:tp-link_systems_inc.:archer_nx200_*, cpe:2.3:a:tp-link_systems_inc.:archer_nx210_*, cpe:2.3:a:tp-link_systems_inc.:archer_nx500_*, and cpe:2.3:a:tp-link_systems_inc.:archer_nx600_*. Firmware patches are available from the vendor at the following support pages: https://www.tp-link.com/en/support/download/archer-nx200/#Firmware, https://www.tp-link.com/en/support/download/archer-nx210/#Firmware, https://www.tp-link.com/en/support/download/archer-nx500/#Firmware, and https://www.tp-link.com/en/support/download/archer-nx600/#Firmware. The vendor advisory is located at https://www.tp-link.com/us/support/faq/5027/.
Remediation
Immediately download and install the latest firmware for your specific Archer NX-series router model from the TP-Link support pages (https://www.tp-link.com/en/support/download/) for your device (NX200, NX210, NX500, or NX600). Each product line has dedicated firmware updates that address the authentication bypass. Until patching is complete, implement the following mitigations: disable remote management of the router's web interface (restrict access to the web UI to only local network addresses via firewall rules), change the default admin credentials to a strong password, and if possible, place the router behind an additional network firewall that restricts inbound HTTP/HTTPS traffic to trusted administrative sources only. For enterprises managing multiple Archer NX devices, establish a patch management schedule and verify successful updates by checking the firmware version in the router's administration panel after reboot. Refer to the official advisory at https://www.tp-link.com/us/support/faq/5027/ for device-specific patching instructions.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today