CVE-2025-15568highCWE-78

CVE-2025-15568: high-severity vulnerability in TP-Link Systems Inc. Archer AXE75 v1.6/v1.0

Command Injection Vulnerability on TP-Link Archer AXE75

Published · Updated

Follow this CVE+ Monitor Archer AXE75 v1.6/v1.0

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 1.6%
In short

A flaw in the TP-Link Archer AXE75 router allows an attacker on the same network to run malicious commands with administrator privileges if the router is set to access point mode. This could let them steal data, modify settings, or shut down the device.

Technical detail

Command injection vulnerability in the web module of Archer AXE75 (v1.6/v1.0 through 1.3.2 Build 20250107) when sysmode=ap. Authenticated adjacent-network attacker can inject arbitrary OS commands via unsanitized input, achieving RCE with root privileges and compromising confidentiality, integrity, and availability of the device.

Summary generated and translated by AI from the official description.
A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device. This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107.
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected products
TP-Link Systems Inc. · Archer AXE75 v1.6/v1.0