High 8.1

SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows...

CVE-2025-62501 First seen on SecPulse Feb 4, 03:52

Affected packages

Ecosystem	Package	Affected	Fixed
TP-Link Systems Inc.	Archer AX53 v1.0	≤ 1.3.1 Build 20241120	—
TP-Link Systems Inc.	Archer BE3600 v1	< (KR)_1.2.2 Build 20260903	(KR)_1.2.2 Build 20260903
TP-Link Systems Inc.	Archer BE3600 v1.2	< (KR)_1.2.2 Build 20260903	(KR)_1.2.2 Build 20260903

Original description The description as published by the source.

SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: High 8.1; CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4: High 7.0; CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Published: Feb 4, 2026
First seen on SecPulse: Feb 4, 03:52
GHSA: GHSA-32vw-wgfh-pxr5
CWE: CWE-322

NVD GitHub Advisory

Tags(click for explanation)

All

Cwe 322 Tp Link Systems Inc Archer Ax53 V10 Archer Be3600 V1 Archer Be3600 V12 Archer Ax53 Firmware Archer Ax53

Vendors

Tp Link

Detection sources

NIST National Vulnerability Database04:16
GitHub Security Advisories (Global)06:31
CVE.org (CVE Program・cvelistV5)09:17