EUVD-2025-208943Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of device configuration data.
AnalysisAI
A hardcoded cryptographic key in the configuration mechanism of TP-Link Archer NX series routers (NX200, NX210, NX500, NX600) allows authenticated attackers to decrypt, modify, and re-encrypt device configuration files, compromising both confidentiality and integrity of router settings. This vulnerability affects multiple hardware versions across all four product lines, with patches now available from the vendor. While no public exploit code or active KEV status has been reported, the authenticated attack requirement and widespread deployment of these consumer routers present moderate real-world risk.
Technical ContextAI
The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a common configuration management flaw in embedded devices. TP-Link Archer routers employ a symmetric encryption mechanism to protect configuration data—likely AES or similar—using a static key embedded in firmware rather than dynamically generated or derivable credentials. The affected products include Archer NX200 (versions 2.0, 2.20, 3.0), Archer NX210 (versions 2.0/2.20, 3.0), Archer NX500 (versions 1.0, 2.0), and Archer NX600 (versions 1.0, 2.0, 3.0) as confirmed via CPE identifiers (cpe:2.3:a:tp-link_systems_inc.:archer_nx*). By reverse-engineering firmware or obtaining the hardcoded key through static analysis, an authenticated user with local or remote administrative access can decrypt configuration exports, modify sensitive parameters (DHCP settings, firewall rules, DNS configuration, SSID credentials), and re-encrypt them for reload, bypassing intended security controls.
RemediationAI
Immediately download and install the latest firmware for your specific Archer NX model from the TP-Link support pages linked above (https://www.tp-link.com/en/support/download/archer-nx200/#Firmware for NX200, etc.); firmware updates contain the corrected cryptographic key handling and eliminate the hardcoded key vulnerability. Until firmware can be applied, restrict administrative access to the router's management interface using strong passwords and disabling remote management features if not required, and isolate router administrative traffic to trusted networks only. Additionally, monitor configuration backups for unauthorized access and consider exporting the current configuration as a baseline to detect tampering. Verify successful patch installation by confirming firmware version matches the latest release in the vendor advisory at https://www.tp-link.com/us/support/faq/5027/.
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models be
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_set
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_sta
TP-Link Archer C7 and TL-WR841N routers contain an authenticated remote command execution vulnerability in the Parental
A vulnerability in the TP-Link Archer c20 router with firmware version V6.6_230412 and earlier permits unauthorized indi
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today