Archer Nx600 V3 0 CVE-2025-15519

While no CVSS score or EPSS value has been published, this vulnerability carries inherently high real-world risk due to its characteristics: the attack vector is network (CLI access over management port), the required privilege level is administrative (reducing attack surface to compromised or authorized accounts), the impact scope is complete (affects confidentiality, integrity, and availability), and the CWE-78 class has historically been both highly exploitable and frequently automated. The barrier to exploitation is low—command injection typically requires no advanced exploit techniques once authentication is obtained. The lack of published EPSS or CVSS vector data does not diminish the threat; rather, it suggests this is a recently disclosed or embargoed vulnerability. Given that patches are available and the vendor has published advisories, organizations should prioritize this as a medium-to-high priority remediation task, particularly for internet-facing or multi-tenant deployments where unauthorized administrative access could occur. This is not a low-real-risk scenario; it is a legitimate privilege-escalation and system-compromise vector.

An authenticated attacker who has gained access to a router's administrative credentials (via phishing, credential stuffing, or insider threat) connects to the device's CLI management interface. The attacker targets the modem-management CLI command and injects a shell metacharacter sequence (e.g., command; malicious_payload) into a parameter field that is expected to receive benign input such as a modem configuration value. The router's CLI handler concatenates this untrusted input directly into a system command without sanitization, causing the injected payload to be executed with the privileges of the router's administrative process. The attacker thus achieves arbitrary command execution, potentially extracting configuration, modifying firewall rules, exfiltrating traffic logs, or pivoting to downstream network devices.