A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 24 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link archer Nx200 V1.0
Tp-link archer Nx200 V2.0
Tp-link archer Nx200 V2.20
Tp-link archer Nx200 V3.0
Tp-link archer Nx210 V2.0 V2.20
Tp-link archer Nx210 V3.0
Tp-link archer Nx500 V1.0
Tp-link archer Nx500 V2.0
Tp-link archer Nx600 V1.0
Tp-link archer Nx600 V2.0
Tp-link archer Nx600 V3.0
Vendors & Products Tp-link
Tp-link archer Nx200 V1.0
Tp-link archer Nx200 V2.0
Tp-link archer Nx200 V2.20
Tp-link archer Nx200 V3.0
Tp-link archer Nx210 V2.0 V2.20
Tp-link archer Nx210 V3.0
Tp-link archer Nx500 V1.0
Tp-link archer Nx500 V2.0
Tp-link archer Nx600 V1.0
Tp-link archer Nx600 V2.0
Tp-link archer Nx600 V3.0

Mon, 23 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Mon, 23 Mar 2026 18:15:00 +0000

Type Values Removed Values Added
Description A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.
Title Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-03-24T03:56:05.005Z

Reserved: 2026-01-13T19:43:48.978Z

Link: CVE-2025-15517

cve-icon Vulnrichment

Updated: 2026-03-23T19:07:19.207Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-23T18:16:22.347

Modified: 2026-03-24T15:54:09.400

Link: CVE-2025-15517

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-24T10:33:30Z

Weaknesses