CVE-2025-15517

Katalog CVE

CVSS 8.1 · High EPSS 3,0%

Kerentanan Missing Authentication for Critical Function pada tp-link archer nx600 firmware, tp-link archer nx500 firmware +2 lainnya. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

Rincian

Terbit di NVD

23 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 86,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5027/ advisory vendor
• https://www.tp-link.com/en/support/download/archer-nx200/#Firmware product
• https://www.tp-link.com/en/support/download/archer-nx210/#Firmware product
• https://www.tp-link.com/en/support/download/archer-nx500/#Firmware product
• https://www.tp-link.com/en/support/download/archer-nx600/#Firmware product