Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-9961

38
FAUCET Score

CVE-2025-9961 describes a high-severity vulnerability (CVSS 8.6) allowing authenticated attackers to remotely execute arbitrary code on specific versions of AX10 and AX1500 devices via the CWMP binary. This exploit requires a Man-In-The-Middle (MITM) attack, indicating a moderate attack complexity despite the high impact of full system compromise. While the vulnerability is significant, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or notable community discussion or media coverage. Organizations should prioritize patching affected devices, specifically AX10 V1/V1.2/V2/V2.6/V3/V3.6 before 1.2.1 and AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6 before 1.3.11, to mitigate this risk.

Impacted Technologies

VendorProductVersion(s)CPE
TP-Link Systems Inc.AX10 V1/V1.2/V2/V2.6/V3/V3.6
>= 0, < 1.2.1CNA affecteddefault unaffected
TP-Link Systems Inc.AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6
>= 0, < 1.3.11CNA affecteddefault unaffected

CVSS Data

CVSS version used by this source: 4.0

8.6HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
NONE
VS Confidentiality
HIGH
VS Integrity
HIGH
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
9.82%
Probability of exploitation in next 30 days
EPSS Percentile
95.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0982 is in the 93rd percentile among its peer group of 5,531 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (1)

watchguardpatch availablevia llm_extracted
View patch

Vendor Advisories (1)

watchguardllm-watchguard-eb93ecc2bace53e1

Statement on Authenticated RCE by CWMP binary

References

blog.byteray.co.uk / zero-day-alert-automated-discovery-of-critical-cwmp-stack-overflow-in-tp-link-routers-0bc495a08679
tp-link.com / us/support/download/archer-ax10
tp-link.com / us/support/download/archer-ax1500
tp-link.com / us/support/faq/4647