8.6 HighCWE-306
CVE-2025-15517
Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600
TP-Link Systems Inc.Archer NX600 v3.0
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
3.1%probability of exploitation in the next 30 days
Higher than 88% of scored CVEs
SeverityCVSS
8.6High
Description NVD
A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.
Coverage 2 articles · 2 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 25 Mar · 15:48 UTC | Security Affairs | Patch now: TP-Link Archer NX routers vulnerable to firmware takeover |
| Fri 27 Mar · 12:10 UTC | SecurityWeek | TP-Link Patches High-Severity Router Vulnerabilities |
- TP-Link Patches High-Severity Router VulnerabilitiesSecurityWeek
- Patch now: TP-Link Archer NX routers vulnerable to firmware takeoverSecurity Affairs · first in our coverage