CVE-2026-0620

6.0 mediumEPSS 0.3%

Medium (6.0). EPSS 0.3% chance of exploitation in the next 30 days.

When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality.

Severity

CVSS 4.0

6.0 medium

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-693
Published: 2026-02-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.tp-link.com/en/support/download/archer-axe75/v1/#Firmware
https://www.tp-link.com/us/support/download/archer-axe75/v1/#Firmware
https://www.tp-link.com/us/support/faq/4942/

Check your stack JSON