← Back

CVE-2025-15551

nvd nist
Published: Feb 5, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.9
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: f23511db-6c3e-4e32-a477-6aa17d310630 (Secondary)

Description

The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

Affected (4)

Tp Link
4 products
Archer Mr200 Firmware
Archer C20 Firmware
Tl Wr850n Firmware
Tl Wr845n Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Archer Mr200 Firmware
Before 250917
Running on/withPlatform Versions
Tp Link
Archer Mr200
Version 5.20
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Archer C20 Firmware
Before 250630
Running on/withPlatform Versions
Tp Link
Archer C20
Version 6
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl Wr850n Firmware
Before 0.9.1_Build251205
Running on/withPlatform Versions
Tp Link
Tl Wr850n
Version 3
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl Wr845n Firmware
Before 251031
Running on/withPlatform Versions
Tp Link
Tl Wr845n
Version 4

Related CWEs

CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

References (10)

Source: f23511db-6c3e-4e32-a477-6aa17d310630
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Product
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Vendor Advisory

Timeline

No history available yet.