CVE-2025-9961 Authenticated RCE by CWMP binary
Authenticated attackers can execute arbitrary code on TP-Link AX10 and AX1500 routers via the CWMP binary using a Man-In-The-Middle attack.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-9961?
CVE-2025-9961 is a high-severity command injection vulnerability in TP-Link Systems Inc. AX10 V1/V1.2/V2/V2.6/V3/V3.6, published on 6 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.
The exploit can only be conducted via a Man-In-The-Middle (MITM) attack.
This issue affects AX10 V1/V1.2/V2/V2.6/V3/V3.6: before 1.2.1; AX1500 V1/V1.20/V1.26/V1.60/V1.80/V2.60/V3.6: before 1.3.11.
Weakness: CWE-120
Which versions are affected by CVE-2025-9961?
How do I fix CVE-2025-9961?
No fix has been published for CVE-2025-9961 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-9961 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9961 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-mrm5-v7mh-6mmq.