TP-Link Routers Hit by 2025 Zero-Day: What You Need to Know About the CWMP Exploit
In September 2025, TP-Link confirmed a critical zero-day vulnerability impacting multiple router models, including Archer AX10 and AX1500. Discovered by independent researcher Mehrun (ByteRay), the stack-based buffer overflow exists within the routers' CWMP (CPE WAN Management Protocol) implementation, specifically in handling SOAP messages due to improper validation in 'strncpy' calls. Attackers can exploit this flaw to achieve remote code execution by redirecting devices to malicious CWMP servers or leveraging unchanged default credentials, leading to device compromise. Once compromised, adversaries can reroute DNS queries, intercept traffic, and inject malicious payloads, raising severe risks for users and organizations relying on affected devices. The continued exploitation of similar router vulnerabilities by groups like Quad7 botnet highlights a shift in attacker TTPs towards leveraging consumer and SOHO networking devices as entry points and persistence mechanisms. The prevalence of these attacks underscores the urgent need for robust patch management and secure configuration in edge infrastructure.
Kill Chain