Read the docs
TI-2025-14190 Aliases CVE-2025-15551GHSA-q6v4-fwc8-3mpc

LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N

Priority LOW 27CWE-95Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-95.

Summary

The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix Fixed Archer MR200 v5.2 (TP-Link Systems Inc.): 1.2.0 Build 250917 Rel.51746Archer C20 v6 (TP-Link Systems Inc.): 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher MR200 v5.2before 1.2.0 Build 250917 Rel.517461.2.0 Build 250917 Rel.51746Patch availableCNA
TP-LinkArcher C20 v6before 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n0.9.1 4.19 v0001.0 Build 250630 Rel.56583nPatch availableCNA
TP-LinkTL-WR850N v3before 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089nPatch availableCNA
TP-LinkTL-WR845N v4before 0.9.1 3.19 Build 251031 rel337100.9.1 3.19 Build 251031 rel33710Patch availableCNA
TP-LinkArcher C20 v5before US_V5_260419; before EU_V5_260317US_V5_260419, EU_V5_260317Patch availableCNA
  • Archer MR200 v5.2 VendorTP-Link Affected before 1.2.0 Build 250917 Rel.51746 Fixed in 1.2.0 Build 250917 Rel.51746 Patch available CNA
  • Archer C20 v6 VendorTP-Link Affected before 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n Fixed in 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n Patch available CNA
  • TL-WR850N v3 VendorTP-Link Affected before 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n Fixed in 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n Patch available CNA
  • TL-WR845N v4 VendorTP-Link Affected before 0.9.1 3.19 Build 251031 rel33710 Fixed in 0.9.1 3.19 Build 251031 rel33710 Patch available CNA
  • Archer C20 v5 VendorTP-Link Affected before US_V5_260419; before EU_V5_260317 Fixed in US_V5_260419, EU_V5_260317 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_mr200_firmware:*:*:*:*:*:*:*:*before 250917VulnerableTP-Link
cpe:2.3:h:tp-link:archer_mr200:5.20:*:*:*:*:*:*:*5.20Running onTP-Link
cpe:2.3:o:tp-link:archer_c20_firmware:*:*:*:*:*:*:*:*before 250630VulnerableTP-Link
cpe:2.3:h:tp-link:archer_c20:6:*:*:*:*:*:*:*6Running onTP-Link
cpe:2.3:o:tp-link:tl-wr850n_firmware:*:*:*:*:*:*:*:*before 0.9.1_Build251205VulnerableTP-Link
cpe:2.3:h:tp-link:tl-wr850n:3:*:*:*:*:*:*:*3Running onTP-Link
cpe:2.3:o:tp-link:tl-wr845n_firmware:*:*:*:*:*:*:*:*before 251031VulnerableTP-Link
cpe:2.3:h:tp-link:tl-wr845n:4:*:*:*:*:*:*:*4Running onTP-Link
  • cpe:2.3:o:tp-link:archer_mr200_firmware:*:*:*:*:*:*:*:* Versions before 250917 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_mr200:5.20:*:*:*:*:*:*:* Versions 5.20 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_c20_firmware:*:*:*:*:*:*:*:* Versions before 250630 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_c20:6:*:*:*:*:*:*:* Versions 6 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tl-wr850n_firmware:*:*:*:*:*:*:*:* Versions before 0.9.1_Build251205 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-wr850n:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tl-wr845n_firmware:*:*:*:*:*:*:*:* Versions before 251031 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tl-wr845n:4:*:*:*:*:*:*:* Versions 4 Running on ·TP-Link

Remediation

  • Fix · CNA Archer MR200 v5.2 (TP-Link Systems Inc.) Fixed in 1.2.0 Build 250917 Rel.51746
  • Fix · CNA Archer C20 v6 (TP-Link Systems Inc.) Fixed in 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n
  • Fix · CNA TL-WR850N v3 (TP Link Systems Inc.) Fixed in 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n
  • Fix · CNA TL-WR845N v4 (TP Link Systems Inc.) Fixed in 0.9.1 3.19 Build 251031 rel33710
  • Fix · CNA Archer C20 v5 (TP-Link Systems Inc.) Fixed in US_V5_260419, EU_V5_260317

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15551
  2. 2026-10-03 Alias added: GHSA-q6v4-fwc8-3mpc

References

Patch 9

Advisory 1

  • TI-2026-00615 Logic Vulnerability on TP-Link Archer C20, Archer AX53 and TL-WR841N v13 CVSS 4.0HIGH 7.2
  • TI-2026-52913 Command Injection in Router Web Management Interface CVSS 4.0HIGH 8.5
  • TI-2023-14256 TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707… CVSS 3.1HIGH 7.5
  • TI-2023-18914 Improper authentication in TP-Link Archer C20 CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences