TP-Link Archer NX200, NX210, NX500 和 NX600 HTTP 服务器端点上的授权绕过

The impact of CVE-2025-15517 is significant due to the ease of exploitation and the potential for complete device compromise. An attacker can leverage this vulnerability to upload malicious firmware, effectively bricking the device or installing malware. They can also modify the router's configuration, redirecting traffic, creating backdoors, or stealing sensitive data. This vulnerability presents a serious risk to network security, as a compromised router can serve as a pivot point for attacks against other devices on the network. The ability to perform privileged actions without authentication significantly lowers the barrier to entry for attackers.

Home users and small businesses relying on TP-Link Archer NX series routers are at risk. Shared hosting environments utilizing these routers for network management are also vulnerable. Users with legacy configurations or those who have not regularly updated their router firmware are particularly susceptible.

1. 2026-03-23Disclosure

   disclosure

1. 已保留2026-01-13
2. 发布日期2026-03-23
3. 修改日期2026-03-24
4. EPSS 更新日期2026-03-31

The primary mitigation for CVE-2025-15517 is to immediately upgrade affected TP-Link Archer NX series routers to firmware version 1.8.0 Build 260311 or later. If upgrading is not immediately feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of the vulnerability, restricting access to the vulnerable CGI endpoints from untrusted networks can provide a layer of defense. Monitor router logs for unusual activity, particularly unauthorized configuration changes or firmware uploads. After upgrading, confirm the fix by attempting to access the vulnerable CGI endpoints without authentication; access should be denied.