VulnHub

Real-time Cybersecurity News

Patch now: TP-Link Archer NX routers vulnerable to firmware takeover

Security Affairs
CVEVulnerabilityPatchUpdateCritical

Overview

TP-Link has addressed a significant security vulnerability in its Archer NX router series, identified as CVE-2025-15517, which has a CVSS score of 8.6. This flaw allows attackers to bypass authentication measures, potentially enabling them to install malicious firmware on affected devices. The vulnerability affects several models, including the Archer NX200, NX210, and NX500, among others. Users of these routers are urged to update their firmware promptly to protect against potential exploits. This incident is particularly concerning as it highlights the risks associated with consumer-grade networking equipment, which often lacks robust security measures.

Key Takeaways

  • Affected Systems: TP-Link Archer NX200, NX210, NX500, and other models in the Archer NX series.
  • Action Required: Users should apply the latest security updates provided by TP-Link for their Archer NX routers to mitigate the vulnerability.
  • Timeline: Disclosed on October 2023

Original Article Summary

TP-Link patched a high severity flaw (CVE-2025-15517) in Archer NX routers that could let attackers bypass authentication and install malicious firmware. TP-Link issued security updates for its Archer NX router series to fix multiple vulnerabilities, including CVE-2025-15517 (CVSS score of 8.6), a critical authentication bypass flaw. The vulnerability impacts multiple models, including NX200, NX210, NX500, […]

Impact

TP-Link Archer NX200, NX210, NX500, and other models in the Archer NX series.

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on October 2023

Remediation

Users should apply the latest security updates provided by TP-Link for their Archer NX routers to mitigate the vulnerability. Specific patch numbers or firmware versions were not mentioned, but users should ensure they are running the most recent firmware available from TP-Link.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Patch, and 2 more.

Read Original Article

Related Coverage

‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems

SecurityWeek

Researchers have discovered a new attack method called 'SymJack' that exploits AI coding agents. By using malicious repositories and deceptive symlinks, attackers can trick these AI systems into installing compromised servers under their control. This allows the attackers to steal sensitive information, disrupt continuous integration pipelines, and inject harmful code into software projects. The implications are significant, especially for companies relying on AI tools for software development, as it exposes them to supply chain attacks that can go unnoticed. Developers and organizations need to be vigilant about the sources of their code and the integrity of the tools they use.

May 27, 2026

GlassWorm Botnet Disrupted

SecurityWeek

Security firms have successfully disrupted the GlassWorm botnet by taking down all four command-and-control channels that the malware relied on. This operation is significant because botnets like GlassWorm can be used by attackers for various malicious activities, such as launching distributed denial-of-service (DDoS) attacks or spreading other malware. By dismantling these C&C channels, researchers have reduced the botnet's ability to control infected devices, which is a win for cybersecurity efforts. This disruption not only impacts the operators of the botnet but also protects potential victims from being exploited. As the threat landscape evolves, ongoing vigilance against such malware remains crucial for both individuals and organizations.

May 27, 2026

Dutch police arrests suspect linked to Ajax football club hack

BleepingComputer

Dutch police have arrested a 35-year-old man in connection with a cyberattack on Ajax Amsterdam, a prominent football club. The hack occurred earlier this year, although specific details about the nature of the attack and the data compromised have not been disclosed. This incident raises concerns about the security measures in place at sports organizations, especially as they handle sensitive information about players, fans, and operations. The arrest is part of ongoing efforts by law enforcement to address cybercrime targeting high-profile entities like sports clubs. As the investigation continues, it serves as a reminder for organizations to strengthen their cybersecurity practices to prevent similar incidents.

May 27, 2026

FBI: Hackers Sending Operatives in Person to Insert USB Drives and Steal Data

SecurityWeek

The FBI has issued a warning about a new tactic being employed by the Silent Ransom Group, which involves sending operatives to law firms to physically insert malicious USB drives into their systems. This method allows hackers to bypass traditional cybersecurity measures, making it easier to steal sensitive data. Law firms are particularly vulnerable due to the confidential information they handle. The FBI's alert emphasizes the importance of employee training and heightened awareness regarding suspicious devices in the workplace. Organizations should review their security protocols to mitigate the risk of such physical infiltration.

May 27, 2026

CISA Urges Immediate Patching of Exploited LiteSpeed cPanel Plugin Zero-Day

SecurityWeek

A recently discovered zero-day vulnerability in the LiteSpeed cPanel plugin has been exploited by attackers to execute scripts with root privileges. This security flaw poses a significant risk to users of LiteSpeed's web server and cPanel, particularly those who have not yet applied the necessary patches. The Cybersecurity and Infrastructure Security Agency (CISA) has urged immediate action to patch this vulnerability, which had been actively exploited before it was resolved last week. Failure to address this issue could leave systems vulnerable to further attacks, potentially compromising sensitive data and system integrity. Users are strongly advised to prioritize updates to safeguard their environments.

May 27, 2026

Cybercriminals increasingly use AI for deepfake-based KYC bypass, report finds

SCM feed for Latest

According to new research from Flashpoint, cybercriminals are increasingly using artificial intelligence to create deepfake technology that can bypass Know Your Customer (KYC) processes. Rather than inventing new AI tools, these threat actors are honing existing technologies to make their attacks more effective. This trend poses a significant risk to financial institutions and companies that rely on KYC protocols to verify customer identities. As deepfakes become more sophisticated, organizations may struggle to differentiate between real and fake identities, leading to potential fraud and security breaches. The report indicates that as these tactics evolve, companies must enhance their verification processes to combat this growing threat.

May 26, 2026