CVE-2025-9961CWE-120

CVE-2025-9961

published September 6, 2025

CVSS
8.6
EPSS
10%
Percentile
95.7
In the wild
Unconfirmed
What it is

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.

The exploit can only be conducted via a Man-In-The-Middle (MITM) attack.

This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.

The record
Technical detail
CVSS
8.6 · NONE
CVSS v4.0
Not supplied
EPSS
0.10479 · 95.7th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2025-09-06T11:15Z
References (4)
https://blog.byteray.co.uk/zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679 · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/archer-ax10/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/download/archer-ax1500/ · f23511db-6c3e-4e32-a477-6aa17d310630https://www.tp-link.com/us/support/faq/4647/ · f23511db-6c3e-4e32-a477-6aa17d310630
EPSS history
Timeline
  • 06 SEP 06:50Z
    Authenticated RCE by CWMP binary
    cvelistv5