How severe is CVE-2025-62501?

CVE-2025-62501 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2025-62501 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-62501?

CVE-2025-62501 affects Tp-link Archer Ax53 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-62501?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-62501 have an EU (EUVD) identifier?

Yes. CVE-2025-62501 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-206674.

When was CVE-2025-62501 published?

CVE-2025-62501 was published on 2026-02-03 and last updated on 2026-06-17.

CVE-2025-62501

CVE-2025-62501 is a high-severity vulnerability in Tp-link Archer Ax53 Firmware with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-322.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v4: 7.0
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-206674
Weakness: CWE-322
Affected product: Tp-link Archer Ax53 Firmware
Published: 2026-02-03
Last modified: 2026-06-17

Description

SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

Frequently asked questions

What is CVE-2025-62501?: SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.
How severe is CVE-2025-62501?: CVE-2025-62501 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2025-62501 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-62501?: CVE-2025-62501 affects Tp-link Archer Ax53 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-62501?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-62501 have an EU (EUVD) identifier?: Yes. CVE-2025-62501 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-206674.
When was CVE-2025-62501 published?: CVE-2025-62501 was published on 2026-02-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:tp-link:archer_ax53_firmware:1.0:*:*:*:*:*:*:*

More vulnerabilities in Tp-link Archer Ax53 Firmware

CVE-2025-15608 — Critical (CVSS 9.8): This vulnerability in AX53 v1 results from insufficient input sanitization in the device’s probe handling logic,…
CVE-2025-15607 — Critical (CVSS 9.8): A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling,…
CVE-2026-0834 — High (CVSS 8.8): Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows…
CVE-2026-30818 — High (CVSS 8.0): An OS command injection vulnerability in the dnsmasq module of TP-Link Archer AX53 v1.0 allows an authenticated…
CVE-2026-30815 — High (CVSS 8.0): An OS command injection vulnerability in the OpenVPN module of TP-Link Archer AX53 v1.0 allows an authenticated…
CVE-2026-30814 — High (CVSS 8.0): A stack-based buffer overflow in the tmpServer module of TP-Link Archer AX53 v1.0 allows an authenticated adjacent…

All CVEs affecting Tp-link Archer Ax53 Firmware →

Other CWE-322 vulnerabilities

CVE-2026-1709 — Critical (CVSS 9.4): A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer…
CVE-2026-11745 — High (CVSS 8.8): A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror…
CVE-2025-13914 — High (CVSS 8.7): A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows…
CVE-2025-20163 — High (CVSS 8.7): A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an…
CVE-2024-47519 — High (CVSS 8.3): Backup uploads to ETM subject to man-in-the-middle interception
CVE-2026-45361 — High (CVSS 8.1): Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH…

Browse all CWE-322 vulnerabilities →