Read the docs
TI-2025-14207 Aliases CVE-2025-15568GHSA-w2f8-wmhh-55xq

Command Injection Vulnerability on TP-Link Archer AXE75

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device. This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01557 75th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher AXE75 v1.6/v1.0up to 1.3.2 Build 20250107—No fix listedCNA
  • Archer AXE75 v1.6/v1.0 VendorTP-Link Affected up to 1.3.2 Build 20250107 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:*before 1.3.2VulnerableTP-Link
cpe:2.3:o:tp-link:archer_axe75_firmware:1.3.2:-:*:*:*:*:*:*1.3.2VulnerableTP-Link
cpe:2.3:o:tp-link:archer_axe75_firmware:1.3.2:build_20250107:*:*:*:*:*:*1.3.2 build_20250107VulnerableTP-Link
cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:h:tp-link:archer_axe75:1.6:*:*:*:*:*:*:*1.6Running onTP-Link
  • cpe:2.3:o:tp-link:archer_axe75_firmware:*:*:*:*:*:*:*:* Versions before 1.3.2 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:archer_axe75_firmware:1.3.2:-:*:*:*:*:*:* Versions 1.3.2 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:archer_axe75_firmware:1.3.2:build_20250107:*:*:*:*:*:* Versions 1.3.2 build_20250107 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_axe75:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:h:tp-link:archer_axe75:1.6:*:*:*:*:*:*:* Versions 1.6 Running on ·TP-Link

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15568
  2. 2026-10-03 Alias added: GHSA-w2f8-wmhh-55xq

References

Patch 3

Advisory 1

  • TI-2026-07948 Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75 CVSS 4.0HIGH 8.5
  • TI-2024-14497 OS command injection in TP-Link Archer AX3000 CVSS 3.1HIGH 8.0
  • TI-2024-14508 OS command injection in TP-Link Archer AX3000 CVSS 3.1HIGH 8.8
  • TI-2025-13718 Arbitrary File Deletion Vulnerability in TP-Link Archer AXE75 CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences