CVE-2025-15568CWE-78

Command Injection Vulnerability on TP-Link Archer AXE75

High · published March 9, 2026

CVSS v4.0
8.5
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device.

This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.01511 · 74.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-09T16:19Z
EPSS history
Timeline
  • 09 MAR 16:19Z
    Command Injection Vulnerability on TP-Link Archer AXE75
    cvelistv5