Read the docs
TI-2025-14233 Aliases CVE-2025-15605GHSA-46q8-mxmv-wf7q

Hardcoded Cryptographic Key in Configuration Encryption Mechanism on TP-Link Archer NX200, NX210, NX500 and NX600

Priority LOW 38CWE-321Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables decryption and re-encryption of device configuration data. An authenticated attacker may decrypt configuration files, modify them, and re-encrypt them, affecting the confidentiality and integrity of device configuration data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed Archer NX600 v3.0 (TP-Link Systems Inc.): 1.3.0 Build 260309Archer NX600 v2.0 (TP-Link Systems Inc.): 1.3.0 Build 260311+9 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher NX600 v3.0before 1.3.0 Build 2603091.3.0 Build 260309Patch availableCNA
TP-LinkArcher NX600 v2.0before 1.3.0 Build 2603111.3.0 Build 260311Patch availableCNA
TP-LinkArcher NX600 v1.0before 1.4.0 Build 2603111.4.0 Build 260311Patch availableCNA
TP-LinkArcher NX500 v2.0before < 1.5.0 Build 260309< 1.5.0 Build 260309Patch availableCNA
TP-LinkArcher NX500 v1.0before 1.3.0 Build 2603111.3.0 Build 260311Patch availableCNA
TP-LinkArcher NX210 v3.0before 1.3.0 Build 2603091.3.0 Build 260309Patch availableCNA
TP-LinkArcher NX210 v2.0 v2.20before 1.3.0 Build 2603111.3.0 Build 260311Patch availableCNA
TP-LinkArcher NX200 v3.0before < 1.3.0 Build 260309< 1.3.0 Build 260309Patch availableCNA
TP-LinkArcher NX200 v2.20before 1.3.0 Build 2603111.3.0 Build 260311Patch availableCNA
TP-LinkArcher NX200 v2.0before 1.3.0 Build 2603111.3.0 Build 260311Patch availableCNA
TP-LinkArcher NX200 v1.0before 1.8.0 Build 2603111.8.0 Build 260311Patch availableCNA
  • Archer NX600 v3.0 VendorTP-Link Affected before 1.3.0 Build 260309 Fixed in 1.3.0 Build 260309 Patch available CNA
  • Archer NX600 v2.0 VendorTP-Link Affected before 1.3.0 Build 260311 Fixed in 1.3.0 Build 260311 Patch available CNA
  • Archer NX600 v1.0 VendorTP-Link Affected before 1.4.0 Build 260311 Fixed in 1.4.0 Build 260311 Patch available CNA
  • Archer NX500 v2.0 VendorTP-Link Affected before < 1.5.0 Build 260309 Fixed in < 1.5.0 Build 260309 Patch available CNA
  • Archer NX500 v1.0 VendorTP-Link Affected before 1.3.0 Build 260311 Fixed in 1.3.0 Build 260311 Patch available CNA
  • Archer NX210 v3.0 VendorTP-Link Affected before 1.3.0 Build 260309 Fixed in 1.3.0 Build 260309 Patch available CNA
  • Archer NX210 v2.0 v2.20 VendorTP-Link Affected before 1.3.0 Build 260311 Fixed in 1.3.0 Build 260311 Patch available CNA
  • Archer NX200 v3.0 VendorTP-Link Affected before < 1.3.0 Build 260309 Fixed in < 1.3.0 Build 260309 Patch available CNA
  • Archer NX200 v2.20 VendorTP-Link Affected before 1.3.0 Build 260311 Fixed in 1.3.0 Build 260311 Patch available CNA
  • Archer NX200 v2.0 VendorTP-Link Affected before 1.3.0 Build 260311 Fixed in 1.3.0 Build 260311 Patch available CNA
  • Archer NX200 v1.0 VendorTP-Link Affected before 1.8.0 Build 260311 Fixed in 1.8.0 Build 260311 Patch available CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_nx600:3.0:*:*:*:*:*:*:*3.0Running onTP-Link
cpe:2.3:o:tp-link:archer_nx500_firmware:*:*:*:*:*:*:*:*before 1.5.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_nx500:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:archer_nx210_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_nx210:3.0:*:*:*:*:*:*:*3.0Running onTP-Link
cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_nx200:3.0:*:*:*:*:*:*:*3.0Running onTP-Link
cpe:2.3:h:tp-link:archer_nx600:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:*before 1.4.0VulnerableTP-Link
  • cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx600:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_nx500_firmware:*:*:*:*:*:*:*:* Versions before 1.5.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx500:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_nx210_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx210:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx200:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx600:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_nx600_firmware:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·TP-Link
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:tp-link:archer_nx600:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:archer_nx500_firmware:*:*:*:*:*:*:*:*before 1.3.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_nx500:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:h:tp-link:archer_nx210:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:h:tp-link:archer_nx210:2.20:*:*:*:*:*:*:*2.20Running onTP-Link
cpe:2.3:h:tp-link:archer_nx200:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
cpe:2.3:h:tp-link:archer_nx200:2.20:*:*:*:*:*:*:*2.20Running onTP-Link
cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:*before 1.8.0VulnerableTP-Link
cpe:2.3:h:tp-link:archer_nx200:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
  • cpe:2.3:h:tp-link:archer_nx600:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_nx500_firmware:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx500:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx210:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx210:2.20:*:*:*:*:*:*:* Versions 2.20 Running on ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx200:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx200:2.20:*:*:*:*:*:*:* Versions 2.20 Running on ·TP-Link
  • cpe:2.3:o:tp-link:archer_nx200_firmware:*:*:*:*:*:*:*:* Versions before 1.8.0 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_nx200:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link

Remediation

  • Fix · CNA Archer NX600 v3.0 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260309
  • Fix · CNA Archer NX600 v2.0 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260311
  • Fix · CNA Archer NX600 v1.0 (TP-Link Systems Inc.) Fixed in 1.4.0 Build 260311
  • Fix · CNA Archer NX500 v2.0 (TP-Link Systems Inc.) Fixed in < 1.5.0 Build 260309
  • Fix · CNA Archer NX500 v1.0 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260311
  • Fix · CNA Archer NX210 v3.0 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260309
  • Fix · CNA Archer NX210 v2.0 v2.20 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260311
  • Fix · CNA Archer NX200 v3.0 (TP-Link Systems Inc.) Fixed in < 1.3.0 Build 260309
  • Fix · CNA Archer NX200 v2.20 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260311
  • Fix · CNA Archer NX200 v2.0 (TP-Link Systems Inc.) Fixed in 1.3.0 Build 260311
  • Fix · CNA Archer NX200 v1.0 (TP-Link Systems Inc.) Fixed in 1.8.0 Build 260311

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Archer NX200 v1.0, Archer NX200 v2.0 and 9 more products — tp-link.com/us/support/faq/5027

    4 records Highest priority Priority MEDIUM 3 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-14156 Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600Priority MEDIUM 45
    • TI-2025-14158 Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600Priority MEDIUM 40
    • TI-2025-14157 Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600Priority MEDIUM 40
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15605
  2. 2026-10-03 Alias added: GHSA-46q8-mxmv-wf7q

References

Patch 4

Advisory 1

  • TI-2025-14156 Authorization Bypass in HTTP Server Endpoints on TP-Link Archer NX200, NX210, NX500 and NX600 CVSS 4.0HIGH 8.6
  • TI-2025-14158 Command Injection in Modem Management CLI on TP-Link Archer NX200, NX210, NX500 and NX600 CVSS 4.0HIGH 8.5
  • TI-2025-14157 Command Injection in Wireless Control CLI on TP-Link Archer NX200, NX210, NX500 and NX600 CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences