CVE-2025-15551: TP-Link Router RCE Vulnerability

CVE-2025-15551 Overview

CVE-2025-15551 is a Code Injection vulnerability affecting multiple TP-Link router models. The vulnerability exists because responses from the affected routers are executed directly by JavaScript functions like eval() without any validation or sanitization. This design flaw allows attackers to exploit the vulnerability through a Man-in-the-Middle (MitM) attack to execute arbitrary JavaScript code on the router's admin web portal without the user's permission or knowledge.

Critical Impact

Attackers positioned on the adjacent network can intercept and modify router communications to inject malicious JavaScript code, potentially leading to router configuration changes, credential theft, or complete device compromise.

Affected Products

• TP-Link Archer MR200 v5.2
• TP-Link Archer C20 v6
• TP-Link TL-WR850N v3
• TP-Link TL-WR845N v4

Discovery Timeline

• February 5, 2026 - CVE-2025-15551 published to NVD
• February 5, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15551

Vulnerability Analysis

This vulnerability is classified under CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code / Eval Injection). The affected TP-Link routers process server responses through JavaScript's eval() function without implementing proper input validation or sanitization checks. This architectural weakness creates a significant attack surface when an adversary can intercept and modify network traffic between the user's browser and the router's web management interface.

The attack requires the adversary to be positioned on the adjacent network, making this particularly concerning in environments where wireless network access may be shared or where physical proximity to the network is achievable. Once in position, the attacker can intercept HTTP communications destined for the router's admin portal and inject malicious JavaScript payloads that will be automatically executed by the victim's browser.

Root Cause

The root cause of this vulnerability lies in the insecure use of JavaScript's eval() function to process responses from the router. The eval() function executes arbitrary code passed to it as a string, and when combined with untrusted or modifiable input (in this case, network responses that can be intercepted), it creates a code injection vulnerability. The lack of response integrity verification, such as digital signatures or HTTPS enforcement, compounds this issue by allowing Man-in-the-Middle attackers to tamper with responses before they reach the client browser.

Attack Vector

The attack vector requires adjacent network access, meaning the attacker must be on the same local network segment as the victim. The attack flow involves:

1. The attacker positions themselves to intercept network traffic (e.g., through ARP spoofing or rogue access point)
2. The victim accesses the TP-Link router's admin web portal
3. The attacker intercepts the HTTP response from the router
4. The attacker modifies the response to include malicious JavaScript code
5. The victim's browser receives the modified response and executes the injected code via eval()

The vulnerability allows arbitrary JavaScript execution within the context of the router's admin interface, potentially enabling the attacker to modify router settings, extract credentials, or establish persistent access.

Detection Methods for CVE-2025-15551

Indicators of Compromise

• Unexpected changes to router configuration settings, including DNS servers, firewall rules, or wireless settings
• Unusual network traffic patterns indicating potential ARP spoofing or traffic interception on the local network
• Browser developer console logs showing unexpected JavaScript execution or errors when accessing router admin portal
• Unauthorized firmware modifications or suspicious entries in router logs

Detection Strategies

• Monitor for ARP spoofing attacks on the local network using tools that detect ARP table inconsistencies
• Implement network traffic analysis to identify unencrypted HTTP traffic to router management interfaces
• Deploy intrusion detection systems (IDS) configured to alert on suspicious JavaScript patterns or known exploitation techniques
• Review browser security warnings related to certificate issues or mixed content when accessing router admin interfaces

Monitoring Recommendations

• Enable logging on TP-Link routers and regularly review access logs for unauthorized configuration changes
• Implement network segmentation to isolate router management interfaces from general user networks
• Monitor for indicators of Man-in-the-Middle attacks such as duplicate MAC addresses or unusual ARP activity
• Establish baseline configurations for affected routers and alert on deviations

How to Mitigate CVE-2025-15551

Immediate Actions Required

• Update firmware on all affected TP-Link router models to the latest available version from TP-Link's official support portal
• Access router admin interfaces only through wired connections when possible to reduce MitM exposure
• Enable HTTPS for router management if supported by the firmware version
• Implement strong network segmentation and restrict access to router management interfaces

Patch Information

TP-Link has made firmware updates available for the affected router models. Administrators should download and apply the latest firmware from the official TP-Link support pages:

• TP-Link Archer MR200 Firmware Download
• TP-Link Archer C20 Firmware Download
• TP-Link TL-WR850N Firmware Download
• TP-Link TL-WR845N Firmware Download

For additional guidance on firmware issues, refer to the TP-Link FAQ on Firmware Issues.

Workarounds

• Access the router's admin interface only through a wired Ethernet connection rather than over wireless to reduce interception risk
• Use a VPN connection when managing routers remotely to encrypt traffic and prevent tampering
• Implement MAC address filtering and strong wireless security to limit unauthorized network access
• Consider placing management interfaces on a dedicated VLAN accessible only to authorized administrators
• Deploy ARP spoofing detection and prevention mechanisms on the network