Loading vulnerability…
Authentication Bypass in TP-Link Archer NX HTTP Server CGI Endpoints
CVE-2025-15517 is a missing authentication check in the HTTP server of TP-Link Archer NX200, NX210, NX500, and NX600 routers. The flaw affects certain CGI endpoints that are intended to be accessible only to authenticated users. Due to the absent authentication enforcement, an unauthenticated remote attacker can directly invoke privileged HTTP functionality exposed by those endpoints. Reported privileged actions include firmware upload and configuration-related operations, creating an authentication bypass condition in the router management interface.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated attacker to perform privileged administrative HTTP actions on affected routers. Based on the provided content, this includes unauthorized firmware upload and configuration manipulation. In practice, this can enable installation of malicious firmware, unauthorized modification of router settings, compromise of device integrity, and exposure of downstream home or small-business networks that rely on the router as a trust boundary and traffic gateway.
If you can’t patch tonight, do this now.
Apply the latest vendor firmware immediately. Until patching is completed, reduce exposure of the router management plane by restricting access to the administrative HTTP interface and any reachable CGI endpoints to trusted networks only, disabling remote administration if not required, and monitoring for unauthorized configuration changes or unexpected firmware updates. If compromise is suspected, validate firmware integrity and review device configuration before returning the router to service.
Patch, then assume compromise.
TP-Link has released firmware updates for affected Archer NX models and advised customers to immediately install the latest firmware. Based on the provided version information, affected builds are earlier than the following fixed versions: Archer NX600 v3.0 before 1.3.0 Build 260309; NX600 v2.0 before 1.3.0 Build 260311; NX600 v1.0 before 1.4.0 Build 260311; NX500 v2.0 before 1.5.0 Build 260309; NX500 v1.0 before 1.3.0 Build 260311; NX210 v3.0 before 1.3.0 Build 260309; NX210 v2.0/v2.20 before 1.3.0 Build 260311; NX200 v3.0 before 1.3.0 Build 260309; NX200 v2.0/v2.20 before 1.3.0 Build 260311; and NX200 v1.0 before 1.8.0 Build 260311.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.