CVE-2025-62501
Tp-Link Archer Ax53 Firmware 1.0
Raw vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-62501 is a high-severity Key Exchange without Entity Authentication (CWE-322) vulnerability in Tp-Link Archer Ax53 Firmware. Its CVSS base score is 7.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-62501 is an SSH hostkey misconfiguration vulnerability in the tmpserver modules of TP-Link Archer AX53 v1.0 routers. It affects versions through 1.3.1 Build 20241120 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), mapped to CWE-322 (Key Exchange without Entity Authentication). The flaw enables attackers to obtain device credentials via a specially crafted man-in-the-middle (MITM) attack.
Remote attackers with no privileges or user interaction required can exploit this over the network by positioning themselves for an MITM attack, which demands high attack complexity. Successful exploitation allows capture of device credentials, potentially leading to unauthorized access if those credentials are reused elsewhere.
Talos Intelligence advisories, including TALOS-2025-2291, detail the issue, while TP-Link provides firmware downloads on regional support pages (e.g., US, MY, and global) for Archer AX53 v1.0 to mitigate the vulnerability through patching. Security practitioners should verify and apply these updates promptly.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206674
Vulnerability Data
SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.This issue affects Archer AX53 v1.0: through…
more
1.3.1 Build 20241120.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Requiring device identification and authentication before establishing connections prevents unauthenticated key exchanges with unknown devices.
Requiring unique identification and authentication of users before any privileged action stops key exchange from occurring with unauthenticated parties.
Requiring identification and authentication of non-organizational users blocks key exchange with unauthenticated external actors.
Requiring proper cryptographic key establishment and management directly stops unauthenticated key-exchange implementations.
Issuing or obtaining PKI certificates under an approved policy supplies the entity authentication missing from unauthenticated key exchange.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication of services/hardware prevents unauthenticated key exchange.
Identity proofing and binding directly supports verifying actors before key exchange.
Verifying identity assertions mitigates the missing entity authentication in key exchange.
Protecting data-in-transit implies use of authenticated key exchange but does not explicitly require entity authentication.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography mandates authenticated key-exchange mechanisms, directly addressing the lack of entity authentication.
Security testing can detect missing entity authentication during key exchange.
Secure authentication directly prevents unauthenticated key exchange by requiring verified identities before keys are established.
Identity management provides the verified identities required before key exchange occurs.
Network security policies can require authenticated channels, indirectly reducing the risk of unauthenticated key exchange.
Security of network services includes requirements for authenticated key exchange in service protocols.