CVE-2025-62501CWE-322

CVE-2025-62501

High · published February 4, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
45.5
In the wild
Unconfirmed
What it is

SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00554 · 45.5th percentile
Weakness
CWE-322 · Key Exchange without Entity Authentication
Published
2026-02-04T00:16Z
Affected products (1)
ProductVersionsFixed in
tp-link/archer_ax53_firmwareall versions—
References (7)
https://talosintelligence.com/vulnerability_reports/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/en/support/download/archer-ax53/v1/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/kr/support/download/archer-be3600/v1.20/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/kr/support/download/archer-be3600/v1/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/my/support/download/archer-ax53/v1/#Firmware · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/4943/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2291 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 03 FEB 18:52Z
    SSH Hostkey Misconfiguration Vulnerability in TP-Link Archer AX53
    cvelistv5