CVE-2025-15568 in Archer AXE75
Summary
by MITRE • 03/09/2026
A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access may be able to perform remote code execution (RCE) when the router is configured with sysmode=ap. Successful exploitation results in root-level privileges and impacts confidentiality, integrity and availability of the device.
This issue affects Archer AXE75 v1.6/v1.0: through 1.3.2 Build 20250107.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
The command injection vulnerability CVE-2025-15568 resides within the web module of the Archer AXE75 v1.6/v1.0 router firmware, representing a critical security flaw that enables authenticated remote code execution under specific configuration conditions. This vulnerability operates at the intersection of improper input validation and privilege escalation, creating a pathway for attackers to gain unauthorized control over network devices. The flaw manifests when the router operates in access point mode, specifically when sysmode=ap is configured, making it particularly dangerous for enterprise environments where wireless access points are commonly deployed. The vulnerability's classification aligns with CWE-77, which describes command injection flaws that occur when programs execute operating system commands using untrusted input without proper sanitization or validation.
The technical implementation of this vulnerability exploits the router's web interface to process user-supplied input that is subsequently passed to system commands without adequate sanitization. An authenticated attacker with adjacent network access can manipulate input fields within the web administration interface to inject malicious commands that execute with the highest privileges available to the web server process. This privilege escalation to root-level access occurs because the web module operates with elevated permissions to perform administrative functions, and the insufficient input validation allows attackers to bypass security controls. The attack vector requires both authentication credentials and physical or local network proximity, which aligns with ATT&CK technique T1078.004 for valid accounts and T1046 for network service discovery. The vulnerability's exploitation results in complete compromise of the device, enabling attackers to execute arbitrary code, modify system configurations, and potentially establish persistent backdoors.
The operational impact of CVE-2025-15568 extends beyond simple device compromise to encompass full network infrastructure control, particularly affecting organizations that deploy Archer AXE75 routers in access point mode. When exploited, this vulnerability allows attackers to gain complete administrative control over affected devices, potentially enabling them to monitor network traffic, modify routing configurations, disable security features, or use compromised devices as launch points for further attacks within the network. The confidentiality, integrity, and availability triad suffers severe consequences as attackers can exfiltrate sensitive data, modify network configurations, and potentially cause denial of service conditions. Organizations using these routers in enterprise environments face significant risk of lateral movement attacks, as compromised access points can serve as stepping stones for accessing internal network resources. The vulnerability's impact is amplified when considering that many organizations may not regularly update firmware, leaving devices exposed to exploitation for extended periods.
Mitigation strategies for CVE-2025-15568 should prioritize immediate firmware updates from the vendor to address the command injection flaw, as this represents the most effective defense against exploitation. Network administrators should also implement strict access controls limiting administrative access to the router's web interface, ensuring that only authorized personnel with proper credentials can access management functions. The configuration of sysmode=ap should be carefully evaluated, as this specific mode appears to be a prerequisite for exploitation, and organizations may consider alternative configurations if access point functionality is not essential. Network segmentation and monitoring solutions should be deployed to detect anomalous behavior patterns that might indicate exploitation attempts, including unusual command execution patterns or unexpected network traffic. Additional protective measures include implementing network access control lists to restrict access to router management interfaces, enabling two-factor authentication where available, and conducting regular security assessments to identify potentially vulnerable network devices. The ATT&CK framework suggests implementing defensive measures such as process monitoring and input validation controls to prevent command injection attacks, while also emphasizing the importance of network segmentation to limit the impact of successful compromises.