Vulnerability-Lookup

GHSA-Q6V4-FWC8-3MPC

Vulnerability from github – Published: 2026-02-05 18:30 – Updated: 2026-04-23 00:31

Details

The response coming from TP-Link Archer MR200 v5.2, C20 v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

Severity

5.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

5.9 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-15551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-05T18:16:09Z",
    "severity": "MODERATE"
  },
  "details": "The response coming from TP-Link Archer MR200 v5.2, C20 v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check.\u00a0Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router\u0027s admin web portal without the user\u0027s permission or knowledge.",
  "id": "GHSA-q6v4-fwc8-3mpc",
  "modified": "2026-04-23T00:31:12Z",
  "published": "2026-02-05T18:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15551"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/en/support/download/archer-mr200/v5.20/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/in/support/download/archer-mr200/v5.20/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware"
    },
    {
      "type": "WEB",
      "url": "https://www.tp-link.com/us/support/faq/4948"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2025-15551 (GCVE-0-2025-15551)

Vulnerability from cvelistv5 – Published: 2026-02-05 17:22 – Updated: 2026-04-22 21:35

Title

LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N

Summary

The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-05 20:29 UTC

CWE

CWE-95 - Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Assigner

TPLink CNA under the mitre root

CNA scorecard B 87/100 over 109 records in the last 180 days details

References

10 references

URL	Tags
https://www.tp-link.com/en/support/download/arche…	patch
https://www.tp-link.com/en/support/download/arche…	patch
https://www.tp-link.com/in/support/download/tl-wr…	patch
https://www.tp-link.com/en/support/download/tl-wr…	patch
https://www.tp-link.com/in/support/download/arche…	patch
https://www.tp-link.com/in/support/download/arche…	patch
https://www.tp-link.com/in/support/download/tl-wr…	patch
https://www.tp-link.com/us/support/faq/4948/	vendor-advisory
https://www.tp-link.com/us/support/download/arche…	patch
https://www.tp-link.com/en/support/download/arche…	patch

Impacted products

5 products

Vendor	Product	Version
TP-Link Systems Inc.	Archer MR200 v5.2	Affected: 0 , < 1.2.0 Build 250917 Rel.51746 (custom)
TP-Link Systems Inc.	Archer C20 v6	Affected: 0 , < 0.9.1 4.19 v0001.0 Build 250630 Rel.56583n (custom)
TP Link Systems Inc.	TL-WR850N v3	Affected: 0 , < 3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n (custom)
TP Link Systems Inc.	TL-WR845N v4	Affected: 0 , < 0.9.1 3.19 Build 251031 rel33710 (custom)
TP-Link Systems Inc.	Archer C20 v5	Affected: 0 , < US_V5_260419 (custom) Affected: 0 , < EU_V5_260317 (custom)

Credits

Swaroop Dora, Deven Lunkad, Ashutosh Kumar, and S. Venkatesan from IoT Security Research Lab, Indian Institute of Information Technology, Allahabad

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15551",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-05T20:29:20.573672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-05T20:31:56.005Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Archer MR200 v5.2",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "1.2.0 Build 250917 Rel.51746",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer C20 v6",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "0.9.1 4.19 v0001.0 Build 250630 Rel.56583n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-WR850N v3",
          "vendor": "TP Link Systems Inc.",
          "versions": [
            {
              "lessThan": "3.16.0 0.9.1 v6031.0 Build 251205 Rel.22089n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TL-WR845N v4",
          "vendor": "TP Link Systems Inc.",
          "versions": [
            {
              "lessThan": "0.9.1 3.19 Build 251031 rel33710",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Archer C20 v5",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "US_V5_260419",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "EU_V5_260317",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Swaroop Dora, Deven Lunkad, Ashutosh Kumar, and S. Venkatesan from IoT Security Research Lab, Indian Institute of Information Technology, Allahabad"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check.\u0026nbsp;Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router\u0027s admin web portal without the user\u0027s permission or knowledge."
            }
          ],
          "value": "The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check.\u00a0Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router\u0027s admin web portal without the user\u0027s permission or knowledge."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-153",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-153 Input Data Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-95",
              "description": "CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-22T21:35:19.737Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-mr200/v5.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-c20/v6/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/in/support/download/tl-wr850n/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tl-wr845n/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/in/support/download/archer-mr200/v5.20/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/in/support/download/archer-c20/v6/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/in/support/download/tl-wr845n/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/4948/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/archer-c20/v5/#Firmware"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/archer-c20/v5/#Firmware"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2025-15551",
    "datePublished": "2026-02-05T17:22:55.600Z",
    "dateReserved": "2026-01-29T23:07:58.401Z",
    "dateUpdated": "2026-04-22T21:35:19.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted