Which versions of TP-Link are affected by CVE-2025-15519?

CVE-2025-15519 presents significant security risk, a OS command injection vulnerability rated CVSS 8.5.. A patch is available.

How to fix or mitigate CVE-2025-15519?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

TP-Link CVE-2025-15519

Q: What is the CVSS score of CVE-2025-15519?

CVE-2025-15519 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-208940 HIGH

OS Command Injection (CWE-78)

2026-03-23 TPLink

GHSA-553r-96gg-xwgx

TP-Link Command Injection

8.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:15 euvd

EUVD-2025-208940

Analysis Generated

Mar 23, 2026 - 18:15 vuln.today

Patch released

Mar 23, 2026 - 18:15 nvd

Patch available

CVE Published

Mar 23, 2026 - 18:01 nvd

HIGH 8.5

DescriptionCVE.org

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.

AnalysisAI

A command injection vulnerability exists in the modem-management administrative CLI of TP-Link Archer NX-series routers (NX200, NX210, NX500, NX600) due to improper input handling in CLI commands. An authenticated attacker with administrative privileges can inject crafted input into vulnerable CLI parameters to execute arbitrary operating system commands, compromising the confidentiality, integrity, and availability of the device. A patch is available from TP-Link, and no public exploit or active exploitation has been confirmed at this time.

Technical ContextAI

This vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic operating system command injection flaw. The affected TP-Link Archer NX-series devices (confirmed via CPE strings for NX200 v2.0–v3.0, NX210 v2.0–v3.0, NX500 v1.0–v2.0, and NX600 v1.0–v3.0) employ a modem-management administrative CLI that directly passes user-supplied input to system-level command execution without adequate sanitization or validation. The vulnerable CLI command accepts parameters that are concatenated into OS-level shell commands (likely via system(), exec(), or similar unsafe function calls), allowing shell metacharacters and command separators (e.g., semicolons, pipes, backticks) to break out of the intended command context and execute arbitrary code with the privileges of the router's administrative process.

RemediationAI

Immediately upgrade affected TP-Link Archer NX-series routers to the latest patched firmware version available on the vendor support pages (https://www.tp-link.com/en/support/download/). For each model (NX200, NX210, NX500, NX600), download and install the latest firmware release, which contains fixes for the command injection flaw. Until patching is completed, restrict administrative CLI access to trusted administrative networks only, disable remote management interfaces (SSH, Telnet, HTTP admin console) if not required for operations, and monitor administrative account activity for anomalous CLI command patterns. Additionally, enforce strong, unique passwords for administrative accounts and consider implementing network segmentation to isolate management traffic from untrusted networks. After patching, verify firmware integrity and test administrative CLI functionality to ensure proper operation.