CVE-2025-15519: Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-23 · updated 2026-06-17
Weakness: CWE-78

Description

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.

Affected products

TP-Link Archer Nx200 Firmware: before 1.3.0; before 1.8.0 — fixed in 1.3.0, 1.8.0
TP-Link Archer Nx210 Firmware: before 1.3.0 — fixed in 1.3.0
TP-Link Archer Nx500 Firmware: before 1.5.0; before 1.3.0 — fixed in 1.3.0, 1.5.0
TP-Link Archer Nx600 Firmware: before 1.3.0; before 1.4.0 — fixed in 1.3.0, 1.4.0

How to fix

Upgrade to a fixed version: TP-Link Archer Nx200 Firmware 1.3.0, 1.8.0; TP-Link Archer Nx210 Firmware 1.3.0; TP-Link Archer Nx500 Firmware 1.3.0, 1.5.0; TP-Link Archer Nx600 Firmware 1.3.0, 1.4.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-15519 or the next vulnerability affects your stack