This vulnerability (CVE-2025-15551) involves improper neutralization of directives in dynamically evaluated code (CWE-95) in several TP-Link router models. Specifically, the routers' admin web portals execute responses via JavaScript eval() calls without input validation, enabling an attacker who can intercept network traffic (MitM) to inject and execute arbitrary JavaScript code. The CVSS 4.0 base score is 5.9, reflecting medium severity with attack vector as adjacent network and requiring user interaction. The vulnerability affects multiple TP-Link router firmware versions and is currently published without an available patch or vendor advisory detailing remediation.

Successful exploitation allows an attacker positioned to perform a Man-in-the-Middle attack to execute arbitrary JavaScript code within the router's administrative web interface context. This could lead to unauthorized actions on the router's admin portal without the user's knowledge or permission. However, exploitation requires network proximity and user interaction, limiting the scope of impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should minimize exposure to potential MitM attacks by securing their network environment, such as using encrypted management interfaces and avoiding untrusted networks. Monitor TP-Link's official channels for updates regarding patches or mitigations.