RCE in TP-Link Archer Nx200
CVE-2025-15518
Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600 allows crafted input to be executed as part of an operating system command. An authenticated attacker with administrative privileges may execute arbitrary commands on the operating system, impacting the confidentiality, integrity, and availability of the device.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (47.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- TP-Link Archer Nx200 — versions 3.0, 2.0, 2.20
- TP-Link Archer Nx200 Firmware
- TP-Link Archer Nx210 — versions 3.0, 2.0, 2.20
- TP-Link Archer Nx210 Firmware
- TP-Link Archer Nx500 — versions 2.0, 1.0
- TP-Link Archer Nx500 Firmware
- TP-Link Archer Nx600 — versions 3.0, 2.0, 1.0
- TP-Link Archer Nx600 Firmware
- TP-Link Systems Inc. Archer Nx200 V1.0 — versions 0
- TP-Link Systems Inc. Archer Nx200 V2.0 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (Product, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-15518?
- CVE-2025-15518 is a high-severity vulnerability in TP-Link Archer Nx200, classified under OS Command Injection. CVSS score: 7.2/10. Published 2026-03-23.
- How severe is CVE-2025-15518?
- High severity. CVSS v3 base score is 7.2 out of 10.