What’s Vulnerable › Vulnerabilities

CVE-2025-15035: Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-09 · updated 2026-06-17
• Weakness: CWE-20

Description

Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.

Affected products

• TP-Link Systems Inc. AXE75 V1: through 1.3.2

References

• https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/tree/master/2025/PANW-2025-0004
• https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware
• https://www.tp-link.com/jp/support/download/archer-axe75/v1/#Firmware
• https://www.tp-link.com/phppage/preview.php?url=https://www.tp-link.com/en/support/faq/4881/
• https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware

Get alerted when CVE-2025-15035 or the next vulnerability affects your stack