CVE-2025-9961

High

Description

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500. The exploit can only be conducted via a Man-In-The-Middle (MITM) attack. This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.

SeverityHigh

CVSS8.6

Exploit probability—

ProductAX10 V1/V1.2/V2/V2.6/V3/V3.6

PublishedSep 6, 2025

First seenSep 6, 2025

Weakness typeCWE-120CWE-120

How to fix

Update

TP-Link Systems Inc. AX10 V1/V1.2/V2/V2.6/V3/V3.61.2.1 or later
TP-Link Systems Inc. AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.61.3.11 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/4647/

Affected products

Product	Affected versions	Fixed in
TP-Link Systems Inc. AX10 V1/V1.2/V2/V2.6/V3/V3.6	v < 1.2.1	1.2.1
TP-Link Systems Inc. AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6	v < 1.3.11	1.3.11

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.