CVE-2025-9961 describes a high-severity vulnerability (CVSS 8.6) allowing authenticated attackers to remotely execute arbitrary code on specific versions of AX10 and AX1500 devices via the CWMP binary. This exploit requires a Man-In-The-Middle (MITM) attack, indicating a moderate attack complexity despite the high impact of full system compromise. While the vulnerability is significant, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or notable community discussion or media coverage. Organizations should prioritize patching affected devices, specifically AX10 V1/V1.2/V2/V2.6/V3/V3.6 before 1.2.1 and AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 before 1.3.11, to mitigate this risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| TP-Link Systems Inc. | AX10 V1/V1.2/V2/V2.6/V3/V3.6 | >= 0, < 1.2.1CNA affecteddefault unaffected | |
| TP-Link Systems Inc. | AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 | >= 0, < 1.3.11CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.