EUVD-2025-208943Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of device configuration data.
AnalysisAI
A hardcoded cryptographic key in the configuration mechanism of TP-Link Archer NX series routers (NX200, NX210, NX500, NX600) allows authenticated attackers to decrypt, modify, and re-encrypt device configuration files, compromising both confidentiality and integrity of router settings. This vulnerability affects multiple hardware versions across all four product lines, with patches now available from the vendor. While no public exploit code or active KEV status has been reported, the authenticated attack requirement and widespread deployment of these consumer routers present moderate real-world risk.
Technical ContextAI
The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a common configuration management flaw in embedded devices. TP-Link Archer routers employ a symmetric encryption mechanism to protect configuration data—likely AES or similar—using a static key embedded in firmware rather than dynamically generated or derivable credentials. The affected products include Archer NX200 (versions 2.0, 2.20, 3.0), Archer NX210 (versions 2.0/2.20, 3.0), Archer NX500 (versions 1.0, 2.0), and Archer NX600 (versions 1.0, 2.0, 3.0) as confirmed via CPE identifiers (cpe:2.3:a:tp-link_systems_inc.:archer_nx*). By reverse-engineering firmware or obtaining the hardcoded key through static analysis, an authenticated user with local or remote administrative access can decrypt configuration exports, modify sensitive parameters (DHCP settings, firewall rules, DNS configuration, SSID credentials), and re-encrypt them for reload, bypassing intended security controls.
RemediationAI
Immediately download and install the latest firmware for your specific Archer NX model from the TP-Link support pages linked above (https://www.tp-link.com/en/support/download/archer-nx200/#Firmware for NX200, etc.); firmware updates contain the corrected cryptographic key handling and eliminate the hardcoded key vulnerability. Until firmware can be applied, restrict administrative access to the router's management interface using strong passwords and disabling remote management features if not required, and isolate router administrative traffic to trusted networks only. Additionally, monitor configuration backups for unauthorized access and consider exporting the current configuration as a baseline to detect tampering. Verify successful patch installation by confirming firmware version matches the latest release in the vendor advisory at https://www.tp-link.com/us/support/faq/5027/.
More in Archer Nx600 V3 0
View allA missing authentication check in the HTTP server of TP-Link Archer NX-series routers (NX200, NX210, NX500, NX600) allow
A command injection vulnerability exists in the modem-management administrative CLI of TP-Link Archer NX-series routers
A command injection vulnerability exists in the wireless-control administrative CLI command of TP-Link Archer NX series
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today