What’s Vulnerable › Vulnerabilities

CVE-2026-0620: L2TP over IPSec Encryption Failure on ArcherAXE75

• Severity: medium (CVSS 6.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-03 · updated 2026-06-17
• Weakness: CWE-693

Description

When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled.  This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality.

Affected products

• TP-Link Systems Inc. AXE75: before <1.5.1 Build 20251202 — fixed in <1.5.1 Build 20251202

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. AXE75 <1.5.1 Build 20251202. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware
• https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware
• https://www.tp-link.com/us/support/faq/4942/

Get alerted when CVE-2026-0620 or the next vulnerability affects your stack