CVE-2025-15543: Read-Only Root Access via USB Storage Device in TP-Link VX800v

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-29 · updated 2026-06-17
Weakness: CWE-59

Description

Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files.

Affected products

TP-Link Systems Inc. VX800v v1.0: before 800.0.11 — fixed in 800.0.11

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. VX800v v1.0 800.0.11. Check the vendor advisory for mitigations.

References

https://www.tp-link.com/de/support/download/vx800v/#Firmware
https://www.tp-link.com/us/support/faq/4930/

Get alerted when CVE-2025-15543 or the next vulnerability affects your stack