Archer Nx600 V3 0 CVE-2025-15605

Although CVSS and EPSS scores are not provided, the attack vector is 'network' (authenticated access required) and attack complexity is low given the static nature of the cryptographic key. The lack of a CVSSv3 vector suggests either recent disclosure or delayed scoring, but CWE-321 vulnerabilities are typically rated high or critical when they affect configuration integrity. Real-world risk is moderate-to-high: the attack requires authentication (reducing opportunistic exploit likelihood), but an authenticated attacker—whether a family member with router access, a compromised management interface, or an attacker who has obtained administrative credentials—can trivially decrypt and tamper with router configuration without detection. The availability of vendor patches across all four product lines indicates TP-Link took this seriously, and the absence of known public exploits or KEV designation suggests either early-stage disclosure or limited active exploitation at the time of analysis. However, given the simplicity of the flaw (hardcoded key) and the likelihood that security researchers have already identified the key in published firmware, the threat of functional POC code emerging is high.

An authenticated attacker with administrative credentials or physical access to a TP-Link Archer NX router exports the device configuration file (typically available via the web interface or command-line), uses the hardcoded cryptographic key (extractable from publicly available firmware images) to decrypt it, modifies critical settings such as DNS servers to point to malicious resolvers, upstream proxy settings, or firewall rules to whitelist command-and-control traffic, and re-encrypts the modified configuration using the same key. The attacker then reimports the configuration, and the router applies the malicious settings without any cryptographic integrity validation, allowing silent persistence or network hijacking. Given the low attack complexity (standard symmetric decryption) and the likelihood that the hardcoded key has already been shared in security researcher forums, functional exploitation is feasible even without a public POC.