Vulnerability · Published Sep 6, 2025 · Assigned by TPLink
CVE-2025-9961Authenticated RCE by CWMP binary
High 8.6
In plain English
A high-severity buffer overflow in AX10 V1/V1.2/V2/V2.6/V3/V3.6 from TP-Link Systems Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 11.5% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link Systems Inc. | AX10 V1/V1.2/V2/V2.6/V3/V3.6 | 0 – before 1.2.1 |
| TP-Link Systems Inc. | AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 | 0 – before 1.3.11 |
Weakness: CWE-120 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://blog.byteray.co.uk/zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679
- https://www.tp-link.com/us/support/faq/4647/ vendor-advisory
- https://www.tp-link.com/us/support/download/archer-ax10/ patch
- https://www.tp-link.com/us/support/download/archer-ax1500/ patch