EUVD-2025-208940
GHSA-553r-96gg-xwgx
CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Tags
Description
Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.
Analysis
A command injection vulnerability exists in the modem-management administrative CLI of TP-Link Archer NX-series routers (NX200, NX210, NX500, NX600) due to improper input handling in CLI commands. An authenticated attacker with administrative privileges can inject crafted input into vulnerable CLI parameters to execute arbitrary operating system commands, compromising the confidentiality, integrity, and availability of the device. A patch is available from TP-Link, and no public exploit or active exploitation has been confirmed at this time.
Technical Context
This vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic operating system command injection flaw. The affected TP-Link Archer NX-series devices (confirmed via CPE strings for NX200 v2.0–v3.0, NX210 v2.0–v3.0, NX500 v1.0–v2.0, and NX600 v1.0–v3.0) employ a modem-management administrative CLI that directly passes user-supplied input to system-level command execution without adequate sanitization or validation. The vulnerable CLI command accepts parameters that are concatenated into OS-level shell commands (likely via system(), exec(), or similar unsafe function calls), allowing shell metacharacters and command separators (e.g., semicolons, pipes, backticks) to break out of the intended command context and execute arbitrary code with the privileges of the router's administrative process.
Affected Products
TP-Link Archer NX200 (versions 2.0, 2.20, and 3.0), Archer NX210 (versions 2.0/2.20 and 3.0), Archer NX500 (versions 1.0 and 2.0), and Archer NX600 (versions 1.0, 2.0, and 3.0) are all affected, as confirmed by CPE entries (cpe:2.3:a:tp-link_systems_inc.:archer_nx*). Patches are available for all affected models and versions via the TP-Link support portal. Users should visit https://www.tp-link.com/en/support/download/archer-nx200/#Firmware, https://www.tp-link.com/en/support/download/archer-nx210/#Firmware, https://www.tp-link.com/en/support/download/archer-nx500/#Firmware, and https://www.tp-link.com/en/support/download/archer-nx600/#Firmware to obtain the latest firmware. Additional details are available in the TP-Link FAQ at https://www.tp-link.com/us/support/faq/5027/.
Remediation
Immediately upgrade affected TP-Link Archer NX-series routers to the latest patched firmware version available on the vendor support pages (https://www.tp-link.com/en/support/download/). For each model (NX200, NX210, NX500, NX600), download and install the latest firmware release, which contains fixes for the command injection flaw. Until patching is completed, restrict administrative CLI access to trusted administrative networks only, disable remote management interfaces (SSH, Telnet, HTTP admin console) if not required for operations, and monitor administrative account activity for anomalous CLI command patterns. Additionally, enforce strong, unique passwords for administrative accounts and consider implementing network segmentation to isolate management traffic from untrusted networks. After patching, verify firmware integrity and test administrative CLI functionality to ensure proper operation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today