CVE-2025-15517
A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.
脆弱性の種類
A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intended for authenticated users. An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations.
影響を受ける製品
- tp-link archer_nx600_firmware
- tp-link archer_nx600
- tp-link archer_nx500_firmware
- tp-link archer_nx500
- tp-link archer_nx210_firmware
- tp-link archer_nx210
- tp-link archer_nx200_firmware
- tp-link archer_nx200
参考情報
- https://www.tp-link.com/en/support/download/archer-nx200/#Firmware
- https://www.tp-link.com/en/support/download/archer-nx210/#Firmware
- https://www.tp-link.com/en/support/download/archer-nx500/#Firmware
- https://www.tp-link.com/en/support/download/archer-nx600/#Firmware
- https://www.tp-link.com/us/support/faq/5027/