CVE-2025-15568: Archer AXE75 Router RCE Vulnerability

CVE-2025-15568 Overview

A command injection vulnerability has been identified in the web module of the TP-Link Archer AXE75 router (firmware versions v1.6 and v1.0). This vulnerability allows an authenticated attacker with adjacent-network access to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation grants root-level privileges on the device, completely compromising the confidentiality, integrity, and availability of the affected router.

Critical Impact

Authenticated attackers on the local network can achieve root-level remote code execution on vulnerable Archer AXE75 routers configured in Access Point mode, enabling full device compromise.

Affected Products

• TP-Link Archer AXE75 v1.6 (through firmware 1.3.2 Build 20250107)
• TP-Link Archer AXE75 v1.0 (through firmware 1.3.2 Build 20250107)
• Routers configured with sysmode=ap (Access Point mode)

Discovery Timeline

• 2026-03-09 - CVE-2025-15568 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-15568

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS Command Injection. The flaw exists within the web management module of the Archer AXE75 router and specifically affects devices operating in Access Point (AP) mode.

The vulnerability requires the attacker to have authenticated access to the router's web interface and be positioned on an adjacent network (local network segment). While these prerequisites limit the attack surface compared to fully unauthenticated remote exploits, the impact upon successful exploitation is severe—complete root-level access to the device's operating system.

Root-level compromise of a network router has cascading security implications, including the ability to intercept, modify, or redirect network traffic, deploy persistent backdoors, pivot to other network devices, and exfiltrate sensitive data passing through the router.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization in the web module's handling of user-supplied data. When processing certain input parameters, the web application fails to adequately neutralize special characters and shell metacharacters before passing the data to system command execution functions.

This allows an attacker to inject arbitrary OS commands that are then executed with the privileges of the web server process—which on embedded devices like routers typically runs with root or equivalent administrative privileges.

Attack Vector

The attack requires adjacent network access, meaning the attacker must be connected to the same local network segment as the vulnerable router. The attacker must also possess valid authentication credentials for the router's web management interface.

Once authenticated, the attacker can craft malicious input containing shell metacharacters (such as ;, |, &&, or backticks) that break out of the intended command context. The injected commands execute with root privileges, giving the attacker complete control over the device.

The exploitation is only possible when the router is configured in Access Point mode (sysmode=ap), which may limit the number of vulnerable deployments but still presents a significant risk for enterprise and home networks using this configuration.

Detection Methods for CVE-2025-15568

Indicators of Compromise

• Unexpected outbound connections from the router to unknown IP addresses
• Unusual processes running on the router that are not part of normal firmware operation
• Modifications to router configuration files or firmware
• Unexplained changes to DNS settings, firewall rules, or routing tables
• Authentication log entries showing successful logins followed by unusual administrative actions

Detection Strategies

• Monitor web management interface access logs for suspicious parameter values containing shell metacharacters
• Implement network segmentation to limit adjacent network access to router management interfaces
• Deploy network intrusion detection systems (NIDS) to identify anomalous traffic patterns originating from router IP addresses
• Enable logging of all administrative actions on the router and forward logs to a centralized SIEM

Monitoring Recommendations

• Audit router configurations regularly to verify sysmode settings and identify potentially vulnerable deployments
• Monitor for firmware integrity changes using cryptographic checksums when available
• Implement alerting for any administrative logins to router web interfaces outside of maintenance windows
• Review network traffic for unexpected command-and-control communication patterns

How to Mitigate CVE-2025-15568

Immediate Actions Required

• Update TP-Link Archer AXE75 firmware to the latest available version from the official TP-Link support portal
• Change default administrative credentials and enforce strong, unique passwords for router management
• Restrict access to the router's web management interface to trusted IP addresses only
• Consider disabling remote management if not required for operations

Patch Information

TP-Link has released firmware updates to address this vulnerability. Affected users should download and install the latest firmware for their specific hardware version:

• For Archer AXE75 v1: Visit the TP-Link Firmware Download page for v1
• For Archer AXE75 v1.60: Visit the TP-Link Firmware Download page for v1.60
• Additional guidance is available in the TP-Link FAQ Support Article

Ensure firmware updates are only obtained from official TP-Link sources to prevent supply chain compromise.

Workarounds

• Disable Access Point mode (sysmode=ap) if this configuration is not operationally required
• Implement network segmentation to isolate router management interfaces from general user networks
• Use a dedicated management VLAN with strict access controls for administrative access
• Consider placing a firewall or access control list in front of the router management interface to limit exposure

# Network segmentation example using iptables on a Linux gateway
# Restrict access to router management IP from trusted admin subnet only
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.1.1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 443 -j DROP