EUVD-2025-208943CVSS Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Description
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of device configuration data.
Analysis
A hardcoded cryptographic key in the configuration mechanism of TP-Link Archer NX series routers (NX200, NX210, NX500, NX600) allows authenticated attackers to decrypt, modify, and re-encrypt device configuration files, compromising both confidentiality and integrity of router settings. This vulnerability affects multiple hardware versions across all four product lines, with patches now available from the vendor. While no public exploit code or active KEV status has been reported, the authenticated attack requirement and widespread deployment of these consumer routers present moderate real-world risk.
Technical Context
The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a common configuration management flaw in embedded devices. TP-Link Archer routers employ a symmetric encryption mechanism to protect configuration data—likely AES or similar—using a static key embedded in firmware rather than dynamically generated or derivable credentials. The affected products include Archer NX200 (versions 2.0, 2.20, 3.0), Archer NX210 (versions 2.0/2.20, 3.0), Archer NX500 (versions 1.0, 2.0), and Archer NX600 (versions 1.0, 2.0, 3.0) as confirmed via CPE identifiers (cpe:2.3:a:tp-link_systems_inc.:archer_nx*). By reverse-engineering firmware or obtaining the hardcoded key through static analysis, an authenticated user with local or remote administrative access can decrypt configuration exports, modify sensitive parameters (DHCP settings, firewall rules, DNS configuration, SSID credentials), and re-encrypt them for reload, bypassing intended security controls.
Affected Products
TP-Link Archer NX200 versions 2.0, 2.20, and 3.0 are affected, as are Archer NX210 versions 2.0/2.20 and 3.0, Archer NX500 versions 1.0 and 2.0, and Archer NX600 versions 1.0, 2.0, and 3.0. All variants are confirmed via CPE identifiers published by TP-Link. Firmware updates addressing this vulnerability are available at https://www.tp-link.com/en/support/download/archer-nx200/#Firmware, https://www.tp-link.com/en/support/download/archer-nx210/#Firmware, https://www.tp-link.com/en/support/download/archer-nx500/#Firmware, and https://www.tp-link.com/en/support/download/archer-nx600/#Firmware respectively. Additional details are available in the vendor security advisory at https://www.tp-link.com/us/support/faq/5027/.
Remediation
Immediately download and install the latest firmware for your specific Archer NX model from the TP-Link support pages linked above (https://www.tp-link.com/en/support/download/archer-nx200/#Firmware for NX200, etc.); firmware updates contain the corrected cryptographic key handling and eliminate the hardcoded key vulnerability. Until firmware can be applied, restrict administrative access to the router's management interface using strong passwords and disabling remote management features if not required, and isolate router administrative traffic to trusted networks only. Additionally, monitor configuration backups for unauthorized access and consider exporting the current configuration as a baseline to detect tampering. Verify successful patch installation by confirming firmware version matches the latest release in the vendor advisory at https://www.tp-link.com/us/support/faq/5027/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today