TP-Link Archer AXE75 L2TP/IPSec VPN Encryption Vulnerability

A vulnerability exists in the TP-Link Archer AXE75 V1 router when it is configured as an L2TP/IPSec VPN server. The router may accept L2TP connections without IPSec encryption, even if IPSec is enabled. This flaw can lead to unencrypted VPN sessions, exposing data in transit and compromising confidentiality.

Impact

The vulnerability allows for unencrypted VPN sessions, exposing data in transit and compromising confidentiality.

Remediation

Users are advised to update to the latest firmware version, specifically version 1.5.1 Build 20251202 or later, and to ensure that IPSec is enforced after updating.