TP-Link has patched several vulnerabilities in its Archer NX router series, including a critical-severity flaw that may allow attackers to bypass authentication and upload new firmware.

Tracked as CVE-2025-15517, this security flaw affects Archer NX200, NX210, NX500, and NX600 wireless routers and stems from a missing authentication weakness that attackers can exploit without privileges.

"A missing authentication check in the HTTP server to certain cgi endpoints allows unauthenticated access intended for authenticated users," TP-Link explained earlier this week when it released security updates that address the vulnerability.

"An attacker may perform privileged HTTP actions without authentication, including firmware upload and configuration operations."

TP-Link also removed a hardcoded cryptographic key (CVE-2025-15605) in the configuration mechanism, which allowed authenticated attackers to decrypt configuration files, modify them, and re-encrypt them.

Additionally, it addressed two command injection vulnerabilities (CVE-2025-15518 and CVE-2025-15519) that enable threat actors with admin privileges to execute arbitrary commands.

The company "strongly" recommended that customers download and install the latest firmware version to block potential attacks exploiting these flaws.

"If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory," it added.

In September, TP-Link was forced to rush out patches for a zero-day vulnerability impacting multiple router models after failing to release patches following a May 2024 report. The unpatched security flaw allowed attackers to intercept or manipulate unencrypted traffic, reroute DNS queries to malicious servers, and inject malicious payloads into web sessions.

CISA added two other TP-Link flaws (CVE-2023-50224 and CVE-2025-9377) to its Known Exploited Vulnerability catalog in September, which the Quad7 botnet has been exploiting to compromise vulnerable routers.

In total, the U.S. cybersecurity agency has flagged six TP-Link vulnerabilities as exploited in attacks, the oldest being a directory traversal vulnerability (CVE-2015-3035) affecting multiple Archer devices.

Texas Attorney General Paxton sued TP-Link Systems in February, accusing the company of deceptively promoting its routers as secure while allowing Chinese state-sponsored hacking groups to exploit firmware vulnerabilities and access users' devices.

This week, the U.S. Federal Communications Commission has also updated its Covered List to include all consumer routers made in foreign countries, banning the sale of new routers made outside the U.S. due to an "unacceptable risk to the national security."