CVE-2025-15545: TP-Link Archer RE605X Firmware

Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the injected tag is interpreted by a shell, allowing execution of arbitrary commands with root privileges. Successful exploitation allows the attacker to gain root-level command execution, compromising confidentiality, integrity and availability.

Affected products

• TP-Link Archer RE605X Firmware: before 1.2.10 (fixed in 1.2.10)

Published 2026-01-29. Last modified 2026-06-17.