TP‑Link Archer NX Router Auth Bypass CVE‑2025‑15517

Affected Environment
TP‑Link Archer NX200, NX210, NX500, and NX600 routers running affected firmware builds. Exposure exists where these devices are deployed in your network.

Threat Overview
A critical HTTP authentication bypass (CVE‑2025‑15517) allows privileged actions without login. Two command‑injection flaws further increase risk on compromised routers.

Exposure Timeline
TP‑Link released fixes and public guidance on 25 March 2026. Devices remain exposed until the latest firmware is identified, scheduled, and fully deployed.

Attack Surface
Internet‑accessible administration and HTTP services on Archer NX routers form the main attack surface. Remote management significantly increases reachable exposure.

Technical Root Cause
A missing authentication check on specific HTTP CGI endpoints permits privileged operations. Additional improper input handling in CLI commands enables command injection.

Exploitation Pathway
An unauthenticated attacker can call vulnerable CGI endpoints to upload firmware or alter configuration. Authenticated admins can be leveraged to run arbitrary OS commands.