Back Csa.Sg

Critical Vulnerability in TP-Link Archer Products - Cyber Security Agency of Singapore (CSA)

Csa.Sg • March 26, 2026

TP-Link has released a security advisory addressing multiple vulnerabilities on TP-Link Archer products. Users and administrators of affected products are advised to update to the latest versions immediately.

TP-Link has released a security advisory addressing multiple vulnerabilities (CVE-2025-15517, CVE-2025-15518, CVE-2025-15519 and CVE-2025-15605) on TP-Link Archer NX200, NX210, NX500 and NX600 products. The vulnerabilities include authentication bypass and input validation flaws that could allow attackers to gain unauthorised access or execute malicious commands.

Successful exploitation of these vulnerabilities could allow:

CVE-2025-15517: An unauthenticated attacker to perform privileged administrative actions via exposed Hypertext Transfer Protocol (HTTP) endpoints, which may result in unauthorised firmware uploads and configuration changes.

CVE-2025-15518 & CVE-2025-15519: An authenticated attacker with administrative privileges to execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.

CVE-2025-15605: An unauthenticated attacker to decrypt, modify and re-encrypt configuration files, compromising the confidentiality and integrity of device configuration data.

The following products hardware/firmware versions are affected by the vulnerabilities.

Versions prior to TP-Link Archer NX600

v3.0: < 1.3.0 Build 260309

v2.0: < 1.3.0 Build 260311

v1.0: < 1.4.0 Build 260311

Versions prior to TP-Link Archer NX500

v2.0: < 1.5.0 Build 260309

v1.0: < 1.3.0 Build 260311

Versions prior to TP-Link Archer NX210

v3.0: < 1.3.0 Build 260309

v2.0 & v2.20: < 1.3.0 Build 260311

Versions prior to TP-Link Archer NX200

v3.0: < 1.3.0 Build 260309

v2.20: < 1.3.0 Build 260311

v2.0: < 1.3.0 Build 260311

v1.0: < 1.8.0 Build 260311

Users and administrators of affected product versions are advised to update to the latest versions immediately.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in TP-Link Archer Routers Expose Users to Attacks TP-Link has patched multiple critical vulnerabilities in its Archer NX router series, specifically affecting models NX200, NX210, NX500, and NX600. The most severe flaw, CVE-2025-15517, allows unauthenticated attackers to bypass authentication and upload malicious firmware. Other vulnerabilities, CVE-2025-15518 and CVE-2025-15519, enable authenticated attackers to execute arbitrary commands on the operating system. Additionally, CVE-2025-15605 allows attackers to decrypt and modify configuration files. Users are urged to update to the latest firmware versions immediately to mitigate risks. The vulnerabilities have been classified as high severity, with potential impacts on device confidentiality, integrity, and availability. There are no reports of ongoing exploitation at this time, but the vulnerabilities have been flagged by cybersecurity agencies. The situation is compounded by a lawsuit against TP-Link alleging deceptive security practices. 11 sources 74

Extracted Entities

Critical Vulnerability in TP-Link Archer Products - Cyber Security Agency of Singapore (CSA)

The full story

Extracted Entities

Countries (1)

CVEs (4)

MITRE ATT&CK (1)