CVE-2025-15551: LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N

Severity: medium (CVSS 5.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-05 · updated 2026-06-17
Weakness: CWE-95

Description

The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

Affected products

TP-Link Systems Inc. Archer C20 v6: before 250630 — fixed in 250630
TP-Link Archer Mr200 Firmware: before 250917 — fixed in 250917
TP-Link Tl-Wr845N Firmware: before 251031 — fixed in 251031
TP-Link Systems Inc. TL-WR850N v3: before 0.9.1_Build251205 — fixed in 0.9.1_Build251205

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Archer C20 v6 250630; TP-Link Archer Mr200 Firmware 250917; TP-Link Tl-Wr845N Firmware 251031; TP-Link Systems Inc. TL-WR850N v3 0.9.1_Build251205. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-15551 or the next vulnerability affects your stack