Archer Nx600 V3 0 EUVD-2025-208937

This vulnerability presents critical real-world risk despite the absence of a CVSS score in the available data. The attack vector is network-based (accessible remotely if the router's web interface is exposed), requires no authentication or user interaction, and allows unauthenticated attackers to upload firmware and modify device configuration. The CWE-306 classification combined with the ability to perform firmware uploads—a privileged operation—indicates high technical impact (complete device compromise). The vulnerability affects multiple product lines across multiple firmware versions, increasing the total at-risk user base. Vendor patch availability is confirmed through multiple references (TP-Link support pages for each product line), but real-world exploitation risk remains high given the ease of exploitation (no authentication required, no special knowledge needed) and the critical nature of the affected operations (firmware upload grants root-level control). From a SSVC perspective, this is an exploitation scenario with automatable attack chains (simple HTTP POST/GET requests) and widespread technical impact, making it a priority for immediate patching.

An attacker gains network access to a TP-Link Archer NX router (e.g., via public WiFi or direct internet exposure) and sends an unauthenticated HTTP POST request to a CGI endpoint such as /cgi-bin/upload with a malicious firmware image. Because the HTTP server fails to validate authentication credentials before processing the request, the upload succeeds, and the router installs the attacker's firmware, granting complete control over the device. The attacker can then harvest credentials, intercept traffic, launch further network attacks, or use the router as a botnet node—all without ever entering a password. This attack requires only basic knowledge of HTTP and the router's CGI endpoint structure and can be automated as part of a mass-exploitation campaign targeting vulnerable Archer NX devices.