CVE-2025-15545: tp-link archer re605x firmware

csirt@kutim:~/threat-intel/cve/CVE-2025-15545

CVSS 6.8 · Medium EPSS 0,48%

Kerentanan Improper Input Validation pada tp-link archer re605x firmware. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Successful exploitation allows the attacker to gain root-level command execution, compromising confidentiality, integrity and availability.

Rincian

Terbit di NVD: 29 Januari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.8 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
EPSS (30 hari): 0,48% peluang dieksploitasi; lebih tinggi dari 39,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tp-link	archer re605x firmware	Semua versi sebelum 1.2.10

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.tp-link.com/us/support/faq/4929/ advisory vendor
https://nico-security.com/posts/cve-2025-15545 exploit · advisory pihak ketiga
https://www.tp-link.com/en/support/download/re605x/v3/#Firmware product
https://www.tp-link.com/us/support/download/re605x/v3/#Firmware product

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.