CVE-2025-62501 SSH Hostkey Misconfiguration Vulnerability in Archer Devices
Attackers can intercept SSH host keys via MITM to steal device credentials, enabling unauthorized access to TP-Link Archer AX53 routers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-62501?
CVE-2025-62501 is a high-severity vulnerability in TP-Link Systems Inc. Archer AX53 v1.0, published on 3 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.
Weakness: CWE-322
Which versions are affected by CVE-2025-62501?
It affects 1 product.
Products include Tp-Link Archer Ax53 Firmware.
How do I fix CVE-2025-62501?
No fix has been published for CVE-2025-62501 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-62501 being exploited?
There is no known exploitation of CVE-2025-62501 in the wild and no public exploit code.
Other vulnerabilities in TP-Link Systems Inc. Archer AX53 v1.0
- CVE-2025-62673 Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12
- CVE-2026-30815 OS Command Injection Vulnerability in OpenVPN Module in TP-Link AX53
- CVE-2026-30818 OS Command Injection Vulnerability in dnsmasq Module in TP-Link AX53
- CVE-2025-15608 Buffer Overflow in Network Probe Handling Function of TP-Link Archer AX53 + Archer AX55
- CVE-2026-30814 Buffer Overflow Vulnerability in TP-Link AX53
Sources
Also known as GHSA-32vw-wgfh-pxr5.