PT-2025-36367 · Ax10 +1 · Ax10 +1

Byteray · Published 2025-09-06 · Updated 2025-09-07 · CVE-2025-9961

Positive Technologies · (AI Summary)

CVSS v4.0

8.6

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions:

AX10 versions prior to 1.2.1

AX10 version V1

AX10 version V1.2

AX10 version V2

AX10 version V2.6

AX10 version V3

AX10 version V3.6

AX1500 versions prior to 1.3.11

AX1500 version V1

AX1500 version V1.20

AX1500 version V1.26

AX1500 version V1.60

AX1500 version V1.80

AX1500 version V2.60

AX1500 version V3.6

Description:

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the affected devices. The exploit requires a Man-In-The-Middle (MITM) attack.

Recommendations:

Update AX10 to version 1.2.1 or later.

Update AX1500 to version 1.3.11 or later.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2025-9961

Affected Products

Ax10

Ax1500

References · 8

• https://tp-link.com/us/support/download/archer-ax10 · Patch
• https://tp-link.com/us/support/download/archer-ax1500 · Patch
• https://tp-link.com/us/support/faq/4647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9961 · Security Note
• https://blog.byteray.co.uk/zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679 · Note
• https://twitter.com/offseq/status/1964637389382386144 · Twitter Post
• https://t.me/canyoupwnme/6927 · Telegram Post
• https://twitter.com/CVEnew/status/1964379898740346904 · Twitter Post