Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

Archer C20 v5

Source -

CNA

CNA CVEs -

1

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

0
Related CVEsRelated VendorsRelated AssignersReports
1Vulnerabilities found
CVE-2025-15551
Assigner-TP-Link Systems Inc.
ShareView Details
Assigner-TP-Link Systems Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.04% / 13.50%
||
7 Day CHG~0.00%
Published-05 Feb, 2026 | 17:22
Updated-22 Apr, 2026 | 22:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
LAN Code Execution on TP-Link Archer MR200, Archer C20, TL-WR850N and TL-WR845N

The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript function like eval directly without any check. Attackers can exploit this vulnerability via a Man-in-the-Middle (MitM) attack to execute JavaScript code on the router's admin web portal without the user's permission or knowledge.

Action-Not Available
Vendor-TP Link Systems Inc.TP-Link Systems Inc.TP-Link Systems Inc.
Product-tl-wr845n_firmwaretl-wr850ntl-wr850n_firmwaretl-wr845narcher_mr200archer_mr200_firmwarearcher_c20archer_c20_firmwareArcher MR200 v5.2Archer C20 v6TL-WR850N v3TL-WR845N v4Archer C20 v5
CWE ID-CWE-95
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')