TP-Link Archer NX Routers Patched for Firmware Takeover and Config Decryption Flaws

TP-Link released firmware updates for Archer NX200, NX210, NX500, and NX600 routers to address multiple high-severity vulnerabilities, including CVE-2025-15517, an authentication bypass issue that could let an unauthenticated attacker upload malicious firmware and carry out privileged configuration changes. The flaws affect the Archer NX product line and prompted TP-Link to urge customers to install the latest firmware immediately.

The updates also fix CVE-2025-15605, a hardcoded cryptographic key weakness mapped to CWE-321. That flaw allows an authenticated attacker to decrypt router configuration files, alter them, and re-encrypt them, compromising the confidentiality and integrity of stored settings. Reporting on the patches comes amid broader scrutiny of TP-Link devices, including prior CISA action on other TP-Link router vulnerabilities and wider regulatory attention on foreign-made consumer networking equipment.