CVE-2025-15518

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15518", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-01-13T19:45:14.017Z", "datePublished": "2026-03-23T18:01:39.070Z", "dateUpdated": "2026-03-24T03:55:59.756Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-03-23T18:01:39.070Z"}, "title": "Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Archer NX600 v3.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260309", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX600 v2.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX600 v1.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX500 v2.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "< 1.5.0 Build 260309", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX500 v1.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX210 v3.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260309", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX210 v2.0 v2.20", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v3.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "< 1.3.0 Build 260309", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v2.20", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v2.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v1.0", "platforms": ["Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.0 Build 260311", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device."}]}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-nx200/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-nx210/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-nx500/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-nx600/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5027/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Saifeldeen Aziz from Cyshield", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-15518"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T03:55:59.756Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-23T19:06:06.998051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T19:07:21.303Z"}}], "cna": {"title": "Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Saifeldeen Aziz from Cyshield"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Archer NX600 v3.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260309", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX600 v2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX600 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX500 v2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "< 1.5.0 Build 260309", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX500 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX210 v3.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260309", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX210 v2.0 v2.20", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v3.0", "versions": [{"status": "affected", "version": "0", "lessThan": "< 1.3.0 Build 260309", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v2.20", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v2.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.3.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Archer NX200 v1.0", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.0 Build 260311", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/en/support/download/archer-nx200/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-nx210/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-nx500/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/archer-nx600/#Firmware", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5027/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.", "supportingMedia": [{"type": "text/html", "value": "Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-03-23T18:01:39.070Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15518", "state": "PUBLISHED", "dateUpdated": "2026-03-24T03:55:59.756Z", "dateReserved": "2026-01-13T19:45:14.017Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-03-23T18:01:39.070Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX600 v3.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260309", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX600 v2.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX600 v1.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.4.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX500 v2.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "< 1.5.0 Build 260309", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX500 v1.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX210 v3.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260309", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX210 v2.0 v2.20", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX200 v3.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "< 1.3.0 Build 260309", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX200 v2.20", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX200 v2.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.3.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "Archer NX200 v1.0", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.8.0 Build 260311", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "77429691-1193-4480-A64E-E1FB19D6A073", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx600:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "58132EDD-47B7-4E46-B280-FE58A920AE43", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "70EF52E9-1D92-4778-99C5-3B76B81681FA", "versionEndExcluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx500:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "40D78DBB-CAEA-4C2E-B703-2898B73A0A5E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx210_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "22EA51B1-332E-48BB-BDBA-09A99ECB942F", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx210:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "DA336E76-7910-4780-BCA0-1DA2AA7F9418", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "48125D02-70B1-4448-BB33-4759FF0E3936", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx200:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "BD6E8279-6E92-47B5-9EEB-CD83355EF693", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "77429691-1193-4480-A64E-E1FB19D6A073", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx600:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "D75A95F3-D299-4037-A755-A6818169762F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "34DC2394-8F53-4C1C-A2AC-E23CE5CB6D2F", "versionEndExcluding": "1.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx600:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "0D20EAF3-A85A-42B1-AF19-D72292523593", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx500_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1EC93BA6-FB10-4993-838A-C82FA984B6BB", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx500:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "581891F1-F50F-49B0-AB3D-B56ECF43F78B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx210_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "22EA51B1-332E-48BB-BDBA-09A99ECB942F", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx210:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "0C230FE9-FBA9-4DAB-B7C1-2A270F57915C", "vulnerable": false}, {"criteria": "cpe:2.3:h:tp-link:archer_nx210:2.20:*:*:*:*:*:*:*", "matchCriteriaId": "FA0FC692-C2F1-4C0C-9502-84852BDCD7E3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "48125D02-70B1-4448-BB33-4759FF0E3936", "versionEndExcluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx200:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "A953B18E-F832-4EE9-8821-4F60DC031715", "vulnerable": false}, {"criteria": "cpe:2.3:h:tp-link:archer_nx200:2.20:*:*:*:*:*:*:*", "matchCriteriaId": "10E43B48-2BA2-45ED-9C43-AAD2B021B3D4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "98759C1B-F1B7-4EAC-BC4B-998ACB4B0C0B", "versionEndExcluding": "1.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_nx200:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "4D2C0169-5369-42A5-B4E3-E7DBED807789", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device."}, {"lang": "es", "value": "Manejo inadecuado de entradas en un comando CLI administrativo de control inal\u00e1mbrico en TP-Link Archer NX200, NX210, NX500 y NX600 permite que una entrada manipulada sea ejecutada como parte de un comando del sistema operativo. Un atacante autenticado con privilegios administrativos puede ejecutar comandos arbitrarios en el sistema operativo, impactando la confidencialidad, integridad y disponibilidad del dispositivo."}], "id": "CVE-2025-15518", "lastModified": "2026-06-17T08:37:56.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15518", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-23T18:16:23.630", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-nx200/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-nx210/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-nx500/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product"], "url": "https://www.tp-link.com/en/support/download/archer-nx600/#Firmware"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/5027/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.8.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX200 v1.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx200_v1.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX200 v2.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx200_v2.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX200 v2.20", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx200_v2.20", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,< 1.3.0 Build 260309)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX200 v3.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx200_v3.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX210 v2.0 v2.20", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx210_v2.0_v2.20", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260309)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX210 v3.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx210_v3.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX500 v1.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx500_v1.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,< 1.5.0 Build 260309)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX500 v2.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx500_v2.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.4.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX600 v1.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx600_v1.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260311)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX600 v2.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx600_v2.0", "vendor": "tp-link"}, {"configurations": [{"platform": ["linux"], "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3.0 Build 260309)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Archer NX600 v3.0", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "archer_nx600_v3.0", "vendor": "tp-link"}], "analysis": {"en": {"generated_at": "2026-04-01T03:25:31.118553+00:00", "value": {"mitigation_remediation": ["Upgrade all Archer NX200, NX210, NX500, and NX600 firmware to the latest versions released by TP\u2011Link.", "If an upgrade cannot be applied immediately, limit access to the wireless\u2011control administrative CLI to trusted administrators only.", "Configure strict logging and monitor device logs for any unexpected command execution.", "Ensure default administrative credentials are changed and enforce strong passwords.", "Segment the network to isolate wireless\u2011control devices from critical infrastructure."], "summary": {"action": "Immediate Patch", "impact": "Remote Command Execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all firmware variants of the TP\u2011Link Archer NX200, NX210, NX500 and NX600 models listed by the CNA, including versions 1.0 through 3.0. No specific unaffected versions are indicated in the data.", "description_and_impact": "An improper input handling flaw in the wireless\u2011control administrative command line interface of TP\u2011Link Archer NX200, NX210, NX500 and NX600 series devices allows crafted input to be executed as part of an operating system command. If an attacker can authenticate as an administrator, they can run arbitrary commands on the device, potentially compromising confidentiality, integrity, and availability of the router and any devices connected to it. The flaw is classified as CWE\u201178: Improper Neutralization of Special Elements used in an OS Command.", "risk_and_exploitability": "The CVSS score of 8.5 indicates a high severity, while an EPSS score of less than 1% suggests a low probability of immediate exploitation. The flaw requires authenticated administrator access and is not currently listed in the CISA KEV catalog, but once privileged access is achieved the attacker can gain full control over the device, affecting all aspects of confidentiality, integrity, and availability."}}}}, "created": "2026-03-24T10:33:29.608158+00:00", "updated": "2026-04-02T07:59:27.402054+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$archer_nx200_v1.0", "tp-link$PRODUCT$archer_nx200_v2.0", "tp-link$PRODUCT$archer_nx200_v2.20", "tp-link$PRODUCT$archer_nx200_v3.0", "tp-link$PRODUCT$archer_nx210_v2.0_v2.20", "tp-link$PRODUCT$archer_nx210_v3.0", "tp-link$PRODUCT$archer_nx500_v1.0", "tp-link$PRODUCT$archer_nx500_v2.0", "tp-link$PRODUCT$archer_nx600_v1.0", "tp-link$PRODUCT$archer_nx600_v2.0", "tp-link$PRODUCT$archer_nx600_v3.0"]}