Remote Code Execution Vulnerability in TP-Link AX10 and AX1500 Routers
CVE-2025-9961

8.6HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Ax10 V1/v1.2/v2/v2.6/v3/v3.6
Ax1500 V1/v1.20/v1.26/v1.60/v1.80/v2.60/v3.6
Vendor
CVE Published:
6 September 2025

What is CVE-2025-9961?

A vulnerability has been identified in TP-Link AX10 and AX1500 routers, allowing an authenticated attacker to remotely execute arbitrary code via the CWMP binary. The exploit can be conducted through a Man-In-The-Middle (MITM) attack, making it crucial for users to ensure their devices are updated to the latest firmware versions to mitigate this risk. Specific affected versions include various releases of AX10 and AX1500 prior to their respective patch updates.

Affected Version(s)

AX10 V1/V1.2/V2/V2.6/V3/V3.6 0 < 1.2.1

AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 0 < 1.3.11

References

https://blog.byteray.co.uk/zero-day-alert-automated-disco...
https://www.tp-link.com/us/support/faq/4647/
vendor-advisory
https://www.tp-link.com/us/support/download/archer-ax10/
patch

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-9961 : Remote Code Execution Vulnerability in TP-Link AX10 and AX1500 Routers