CVE-2025-14756: high-severity vulnerability in TP-Link Systems Inc. Archer MR600 v5.0
Authenticated Command Injection Vulnerability in Archer MR600
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
An authenticated attacker can inject and execute system commands on the TP-Link Archer MR600 router through the admin interface, potentially disrupting services or taking control of the device.
Command injection vulnerability in the admin interface of TP-Link Archer MR600 v5 allows authenticated attackers to execute arbitrary system commands via crafted input submitted through the browser developer console; successful exploitation requires prior authentication and is subject to character length restrictions, but can lead to complete device compromise or denial of service.