Command Injection Flaws Expose TP-Link Archer NX Routers to Admin-Level RCE
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 23, 2026
TP-Link Archer NX200, NX210, NX500, and NX600 routers are affected by two high-severity command injection vulnerabilities, tracked as CVE-2025-15518 and CVE-2025-15519. The flaws stem from improper input handling in administrative CLI functions: one in a wireless-control command and the other in a modem-management command. In both cases, crafted input can be incorporated into operating system commands, enabling arbitrary command execution on the underlying device.
The vulnerabilities require an authenticated attacker with administrative privileges, but successful exploitation could compromise the confidentiality, integrity, and availability of affected routers. Both issues are classified as CWE-78 and were published as new CVE records with high-impact CVSS v4.0 scoring. The CVE entries point users to TP-Link firmware download pages and support documentation for remediation guidance.
