CVE Feed

    Dashboard / CVE / CVE-2025-15551

    CVE-2025-15551

    The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

    Published:Feb 5, 2026
    Last Modified:Apr 22, 2026
    EPS:Feb 5, 2026
    EPSS Score:0.00032
    CVSS Score:5.6

    Affected Products

    Vendor
    Tp-link
    Product
    Archer C20
    Vendor
    Tp-link
    Product
    Archer C20 Firmware
    Vendor
    Tp-link
    Product
    Archer Mr200
    Vendor
    Tp-link
    Product
    Archer Mr200 Firmware
    Vendor
    Tp-link
    Product
    Tl-wr845n
    Vendor
    Tp-link
    Product
    Tl-wr845n Firmware
    Vendor
    Tp-link
    Product
    Tl-wr850n
    Vendor
    Tp-link
    Product
    Tl-wr850n Firmware

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-35 Leverage Executable Code in Non-Executable Files

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High