1. Home
  2. CVE Database
  3. CVE-2025-15517
HIGH · 8.1

CVE-2025-15517

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker m...

Vulnerability Description

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
Tp-LinkArcher Nx600 Firmware< 1.3.0
Tp-LinkArcher Nx6003.0
Tp-LinkArcher Nx500 Firmware< 1.5.0
Tp-LinkArcher Nx5002.0
Tp-LinkArcher Nx210 Firmware< 1.3.0
Tp-LinkArcher Nx2103.0
Tp-LinkArcher Nx200 Firmware< 1.3.0
Tp-LinkArcher Nx2003.0

Related Weaknesses (CWE)

CWE-306

References

FAQ

What is CVE-2025-15517?

CVE-2025-15517 is a vulnerability with a CVSS score of 8.1 (HIGH). A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker m...

How severe is CVE-2025-15517?

CVE-2025-15517 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-15517?

Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Archer Nx600 Firmware, Tp-Link Archer Nx600, Tp-Link Archer Nx500 Firmware, Tp-Link Archer Nx500, Tp-Link Archer Nx210 Firmware.