What’s Vulnerable › Vulnerabilities

CVE-2025-15517: Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-23 · updated 2026-06-17
• Weakness: CWE-306

Description

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

Affected products

• TP-Link Archer Nx200 Firmware: before 1.3.0; before 1.8.0 — fixed in 1.3.0, 1.8.0
• TP-Link Archer Nx210 Firmware: before 1.3.0 — fixed in 1.3.0
• TP-Link Archer Nx500 Firmware: before 1.5.0; before 1.3.0 — fixed in 1.3.0, 1.5.0
• TP-Link Archer Nx600 Firmware: before 1.3.0; before 1.4.0 — fixed in 1.3.0, 1.4.0

How to fix

Upgrade to a fixed version: TP-Link Archer Nx200 Firmware 1.3.0, 1.8.0; TP-Link Archer Nx210 Firmware 1.3.0; TP-Link Archer Nx500 Firmware 1.3.0, 1.5.0; TP-Link Archer Nx600 Firmware 1.3.0, 1.4.0. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/archer-nx200/#Firmware
• https://www.tp-link.com/en/support/download/archer-nx210/#Firmware
• https://www.tp-link.com/en/support/download/archer-nx500/#Firmware
• https://www.tp-link.com/en/support/download/archer-nx600/#Firmware
• https://www.tp-link.com/us/support/faq/5027/

Get alerted when CVE-2025-15517 or the next vulnerability affects your stack