EUVD-2025-208939
GHSA-6mq5-gjcx-rvxq
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.
AnalysisAI
A command injection vulnerability exists in the wireless-control administrative CLI command of TP-Link Archer NX series routers (models NX200, NX210, NX500, and NX600) due to improper input handling that allows crafted input to be executed as part of operating system commands. An authenticated attacker with administrative privileges can exploit this vulnerability to execute arbitrary commands on the device, compromising confidentiality, integrity, and availability. Patches are available from the vendor for all affected models and versions.
Technical ContextAI
The vulnerability is a classic OS command injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command) in the administrative CLI interface of TP-Link's wireless-control management component. The affected products are TP-Link Archer NX series routers spanning multiple hardware revisions: Archer NX200 (versions 2.0, 2.20, 3.0), Archer NX210 (versions 2.0/2.20, 3.0), Archer NX500 (versions 1.0, 2.0), and Archer NX600 (versions 1.0, 2.0, 3.0), as documented in the CPE identifiers provided. The root cause stems from insufficient input validation in the wireless-control administrative command parsing logic, where user-supplied input is concatenated into system commands without proper escaping or sanitization, allowing attackers to inject arbitrary shell metacharacters and execute privileged commands with device-level access.
RemediationAI
Immediately download and apply the latest firmware patches from TP-Link's support website for your specific Archer NX model and current firmware version. Visit the model-specific firmware download pages (https://www.tp-link.com/en/support/download/archer-nx200/#Firmware for NX200, and similar URLs for NX210, NX500, and NX600) and upgrade to the latest available firmware release, which contains the command injection fix. If immediate patching is not possible, implement compensating controls by restricting administrative access to trusted network segments only, disabling remote management features where feasible, and ensuring strong authentication mechanisms (unique, complex administrative passwords) are enforced. Additionally, monitor administrative CLI command logs for suspicious activity or unusual command patterns. Once patched, verify the firmware version in the device's web interface to confirm successful application of the security update.
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models be
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_set
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_sta
TP-Link Archer C7 and TL-WR841N routers contain an authenticated remote command execution vulnerability in the Parental
A vulnerability in the TP-Link Archer c20 router with firmware version V6.6_230412 and earlier permits unauthorized indi
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today