Loading vulnerability…
Command Injection in TP-Link Archer NX wireless-control administrative CLI
CVE-2025-15518 is a command injection vulnerability affecting TP-Link Archer NX200, NX210, NX500, and NX600 routers. The flaw is caused by improper input handling in a wireless-control administrative CLI command, where crafted input is incorporated into an operating system command without sufficient sanitization or neutralization. As a result, an authenticated attacker who already has administrative privileges can cause arbitrary commands to be executed on the underlying operating system of the device.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary operating system command execution on the affected router. This can compromise the confidentiality, integrity, and availability of the device, including unauthorized access to sensitive router data and configuration, modification of system or network settings, installation of persistent changes, and disruption of router operation or connected network services.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict access to the administrative CLI and management interfaces to trusted administrators only, limit management exposure to isolated internal networks, disable any unnecessary remote administration paths, and monitor for unexpected administrative activity or command execution on affected devices. Because exploitation requires authenticated administrative access, reducing and tightly controlling admin access materially lowers exposure until firmware updates can be applied.
Patch, then assume compromise.
Apply the vendor-provided firmware updates for affected TP-Link Archer NX200, NX210, NX500, and NX600 devices. TP-Link has released patches for this vulnerability and advised customers to immediately install the latest firmware versions referenced in the vendor support and firmware download pages.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.