Critical Vulnerability in TP-Link Archer Products

CSA Alerts & Advisories (Singapore)

Published March 26th, 2026

Detected March 26th, 2026

Summary

The Cyber Security Agency of Singapore has issued a critical alert regarding multiple vulnerabilities in TP-Link Archer products (NX200, NX210, NX500, NX600). Users are strongly advised to update affected product firmware immediately to mitigate risks of unauthorized access and command execution.

View original document View source feed page

What changed

The Cyber Security Agency of Singapore (CSA) has issued a critical alert concerning multiple vulnerabilities affecting TP-Link Archer NX200, NX210, NX500, and NX600 products. These vulnerabilities, identified by CVE numbers CVE-2025-15517 through CVE-2025-15605, include authentication bypass and input validation flaws. Successful exploitation could allow unauthenticated attackers to perform privileged administrative actions, upload unauthorized firmware, or execute arbitrary commands on the device's operating system, compromising confidentiality, integrity, and availability.

Users and administrators of affected TP-Link Archer product versions are strongly advised to update their firmware to the latest available versions immediately. Failure to do so could expose their networks to significant security risks, including unauthorized access and data compromise. The advisory provides specific version numbers for affected hardware and firmware, directing users to TP-Link's support resources for patching instructions.

What to do next

Update firmware on affected TP-Link Archer products to the latest versions immediately.
Verify that the updated firmware versions address the identified vulnerabilities (CVE-2025-15517, CVE-2025-15518, CVE-2025-15519, CVE-2025-15605).

Source document (simplified)

Alerts

Critical Vulnerability in TP-Link Archer Products

26 March 2026

TP-Link has released a security advisory addressing multiple vulnerabilities on TP-Link Archer products. Users and administrators of affected products are advised to update to the latest versions immediately.

Background

TP-Link has released a security advisory addressing multiple vulnerabilities (CVE-2025-15517, CVE-2025-15518, CVE-2025-15519 and CVE-2025-15605) on TP-Link Archer NX200, NX210, NX500 and NX600 products. The vulnerabilities include authentication bypass and input validation flaws that could allow attackers to gain unauthorised access or execute malicious commands.

Impact

Successful exploitation of these vulnerabilities could allow:

CVE-2025-15517: An unauthenticated attacker to perform privileged administrative actions via exposed Hypertext Transfer Protocol (HTTP) endpoints, which may result in unauthorised firmware uploads and configuration changes.
CVE-2025-15518 & CVE-2025-15519: An authenticated attacker with administrative privileges to execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.
CVE-2025-15605: An unauthenticated attacker to decrypt, modify and re-encrypt configuration files, compromising the confidentiality and integrity of device configuration data.
Affected Products

The following products hardware/firmware versions are affected by the vulnerabilities.

Versions prior to TP-Link Archer NX600
- v3.0: < 1.3.0 Build 260309
- v2.0: < 1.3.0 Build 260311
- v1.0: < 1.4.0 Build 260311
Versions prior to TP-Link Archer NX500
- v2.0: < 1.5.0 Build 260309
- v1.0: < 1.3.0 Build 260311
Versions prior to TP-Link Archer NX210
- v3.0: < 1.3.0 Build 260309
- v2.0 & v2.20: < 1.3.0 Build 260311
Versions prior to TP-Link Archer NX200
- v3.0: < 1.3.0 Build 260309
- v2.20: < 1.3.0 Build 260311
- v2.0: < 1.3.0 Build 260311
- v1.0: < 1.8.0 Build 260311 Recommendations