CVE-2026-3622 is a high-severity vulnerability in the UPnP component of TP-Link TL-WR841N v14 routers. It arises from improper input validation that causes an out-of-bounds read, potentially crashing the UPnP service. Exploitation leads to a denial-of-service condition by disrupting the UPnP functionality. This affects versions prior to EN_0.9.1 4.19 Build 260303 Rel.42399n and US_0.9.1.
CVE-2025-15606 is a high-severity Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 router. It arises from improper input validation (CWE-20), allowing an attacker to send crafted HTTP requests that cause the httpd service to crash, resulting in service interruption. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to availability. The CVSS 4.0 score is 7.1, reflecting its high impact and ease of exploitation. Organizations relying on this router model may experience network outages or degraded service. Mitigation involves applying vendor patches once available, restricting access to the device's management interface, and monitoring for unusual HTTP traffic patterns.
CVE-2025-15605 is a high-severity vulnerability in TP-Link Archer NX series routers, including NX200, NX210, NX500, and NX600 v3.0, caused by a hardcoded cryptographic key used in the device configuration mechanism. An authenticated attacker with low privileges can decrypt, modify, and re-encrypt configuration files, compromising the confidentiality and integrity of device settings. Exploitation does not require user interaction but does require authentication. No known exploits are currently in the wild. This vulnerability affects the security posture of impacted devices by enabling unauthorized configuration changes, potentially leading to network compromise or persistent backdoors. Organizations using these devices should prioritize mitigation steps such as firmware updates, restricting access to management interfaces, and monitoring configuration changes. Countries with significant TP-Link market penetration and strategic reliance on these devices are at higher risk. The CVSS v4.0 score is 8.
CVE-2025-15519 is a high-severity OS command injection vulnerability affecting TP-Link Archer NX600 v3.0 and related models. It arises from improper input validation in an administrative CLI command used for modem management. An authenticated attacker with administrative privileges can inject and execute arbitrary OS commands, compromising device confidentiality, integrity, and availability. Exploitation requires no user interaction but does require high-level privileges. This vulnerability impacts multiple TP-Link Archer models, including NX200, NX210, NX500, and NX600. No known public exploits exist yet, but the CVSS 4.0 score of 8.5 reflects significant risk. Organizations relying on these devices for network connectivity face potential device takeover and network disruption.
CVE-2025-15518 is a high-severity OS command injection vulnerability affecting TP-Link Archer NX600 v3.0 and related models. It arises from improper input handling in a wireless-control administrative CLI command, allowing an authenticated attacker with administrative privileges to execute arbitrary OS commands. Exploitation compromises device confidentiality, integrity, and availability. No user interaction is required beyond authentication, and the vulnerability does not require network-level access beyond administrative privileges. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to affected devices. The CVSS 4.0 score is 8.5, reflecting high impact and relatively low attack complexity. Organizations using these TP-Link devices should prioritize patching or mitigating this vulnerability to prevent potential device takeover and network compromise.
CVE-2025-15517 is a high-severity vulnerability affecting TP-Link Archer NX600 v3.0 and related models, caused by missing authentication checks on certain HTTP CGI endpoints. This flaw allows unauthenticated attackers to perform privileged actions such as firmware uploads and configuration changes without requiring any credentials or user interaction. The vulnerability impacts multiple models including NX200, NX210, NX500, and NX600, exposing critical router management functions to remote exploitation. The CVSS 4.0 score of 8.6 reflects the high impact on confidentiality and integrity with no authentication or user interaction needed, though the attack vector is adjacent network. No known exploits are currently reported in the wild. Organizations using these TP-Link devices risk unauthorized control over network infrastructure, potentially leading to persistent compromise, network disruption, or interception of sensitive data. Mitigation requires immediate firmware updates from the vendor once available, network segmentation to limit access to router management interfaces, and monitoring for suspicious HTTP requests targeting vulnerable endpoints.
This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe handling logic, where unvalidated parameters can trigger a stack-based buffer overflow that causes the affected service to crash and, under specific conditions, may enable remote code execution through complex heap-spray techniques.
Successful exploitation may result in repeated service unavailability and, in certain scenarios, allow an attacker to gain control of the device.
A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allowing log redirection to arbitrary files and concatenation of unvalidated file content into shell commands, enabling authenticated attackers to inject and execute arbitrary commands. Successful exploitation may allow execution of malicious commands and ultimately full control of the device.
A command injection vulnerability was identified in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 due to improper neutralization of special elements used in an OS command. In the router configuration import function allows an authenticated attacker to upload a crafted configuration file that results in execution of OS commands with root privileges during port-trigger processing.
Successful exploitation allows an authenticated attacker to execute system commands with root privileges, leading to full device compromise.
The web interface on multiple Omada switches does not adequately validate certain external inputs, which may lead to out-of-bound memory access when processing crafted requests. Under specific conditions, this flaw may result in unintended command execution.<br>An unauthenticated attacker with network access to the affected interface may cause memory corruption, service instability, or information disclosure. Successful exploitation may allow remote code execution or denial-of-service.
CVE-2026-3841 is a high-severity OS command injection vulnerability in the Telnet CLI of TP-Link TL-MR6400 v5.3 routers. It arises from improper sanitization of input data during certain CLI operations, allowing an authenticated attacker with elevated privileges to execute arbitrary system commands. Exploitation can lead to full device compromise, affecting confidentiality, integrity, and availability. No user interaction is required, but elevated privileges and network access via Telnet are necessary. Although no known exploits are currently in the wild, the vulnerability poses a significant risk due to the critical nature of the device and its role in network infrastructure. Organizations using this router model should prioritize patching or mitigating this issue. Countries with widespread use of TP-Link networking equipment and strategic reliance on such devices are at higher risk.
A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device.
This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107.
A denial-of-service (DoS) vulnerability was identified in Omada EAP610 v3. An attacker with adjacent network access can send crafted requests to cause the device’s HTTP service to crash. This results in temporary service unavailability until the device is rebooted.
This issue affects Omada EAP610 firmware versions prior to 1.6.0.
Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be executed as part of an OS command. An authenticated adjacent attacker may execute arbitrary commands via crafted configuration file, impacting confidentiality, integrity and availability of the device.
This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (web modules) allows authenticated adjacent attacker to read arbitrary files or cause denial of service. This issue affects Deco BE25 v1.0: through 1.1.1 Build 20250822.
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitation requires the presence of an existing client-side injection vulnerability and user access to the affected web interface. Successful exploitation could allow unauthorized disclosure of sensitive information. Fixed in updated Omada Cloud Controller service versions deployed automatically by TP‑Link. No user action is required.
User-controlled input is reflected into the HTML output without proper encoding on TP-Link Archer C60 v3, allowing arbitrary JavaScript execution via a crafted URL. An attacker could run script in the device web UI context, potentially enabling credential theft, session hijacking, or unintended actions if a privileged user is targeted.
A path traversal vulnerability was identified TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails. An attacker can exploit this logic flaw by supplying crafted, URL encoded traversal sequences that bypass directory restrictions and allow access to files outside the intended web root.
Successful exploitation may allow authenticated attackers to get disclosure of sensitive system files and credentials, while unauthenticated attackers may gain access to non-sensitive static assets.
On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise.
