PT-2026-27162 · Tp Link · Archer Nx500+3

Saifeldeen Aziz · Publicado 2026-03-23 · Atualizado 2026-03-28 · CVE-2025-15517

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TP-Link Archer NX200 TP-Link Archer NX210 TP-Link Archer NX500 TP-Link Archer NX600

Description A flaw exists in the HTTP server of the affected devices due to a missing authentication check when accessing specific CGI endpoints. This allows attackers to perform actions intended for authenticated users without proper authorization. These actions include firmware upload and configuration operations. The vulnerable CGI endpoints allow unauthenticated access to privileged HTTP functions.

Recommendations Apply the latest firmware updates available from TP-Link for the Archer NX200. Apply the latest firmware updates available from TP-Link for the Archer NX210. Apply the latest firmware updates available from TP-Link for the Archer NX500. Apply the latest firmware updates available from TP-Link for the Archer NX600.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2025-15517

Produtos afetados

Archer Nx200

Archer Nx210

Archer Nx500

Archer Nx600

Referências · 14

• https://tp-link.com/en/support/download/archer-nx500/#Firmware · Correção
• https://twitter.com/threatcluster/status/2036775231012938131 · Publicação no Twitter
• https://tp-link.com/en/support/download/archer-nx200/#Firmware · Correção
• https://twitter.com/VivekIntel/status/2036848562009760003 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15517 · Nota de Segurança
• https://twitter.com/proficioinc/status/2037514977980903470 · Publicação no Twitter
• https://twitter.com/TweetThreatNews/status/2036845595499892877 · Publicação no Twitter
• https://tp-link.com/en/support/download/archer-nx600/#Firmware · Correção
• https://tp-link.com/en/support/download/archer-nx210/#Firmware · Correção
• https://twitter.com/sovereignexec/status/2037908325153550599 · Publicação no Twitter
• https://twitter.com/CyberDaily_News/status/2036862536402759943 · Publicação no Twitter
• https://tp-link.com/us/support/faq/5027 · Aviso do Fabricante
• https://twitter.com/shah_sheikh/status/2036831677591220567 · Publicação no Twitter
• https://twitter.com/aviatrixtrc/status/2037587352768413825 · Publicação no Twitter