Vulnerability · Published Jan 9, 2026 · Assigned by TPLink
CVE-2025-15035Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75
Medium 6.9
In plain English
A medium-severity improper input validation in Archer AXE75 v1.6 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 76.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Input Validation vulnerability in TP-Link Archer AXE75 v1.6 (vpn modules) allows an authenticated adjacent attacker to delete arbitrary server file, leading to possible loss of critical system files and service interruption or degraded functionality.This issue affects Archer AXE75 v1.6: ≤ build 20250107.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | Archer AXE75 v1.6 | 0 – through build 20250107 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/PaloAltoNetworks/u42-vulnerability-disclosures/tree/master/2025/PANW-2025-0004
- https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware patch
- https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware patch
- https://www.tp-link.com/jp/support/download/archer-axe75/v1/#Firmware patch
- https://www.tp-link.com/phppage/preview.php?url=https://www.tp-link.com/en/support/faq/4881/ vendor-advisory