When configured as an L2TP/IPSec VPN server, the Archer AXE75 V1 router can unintentionally accept L2TP connections that lack IPSec encryption, even when the IPSec layer is enabled. This defect allows an attacker to establish a VPN tunnel that is not protected by encryption, exposing all data that traverses the tunnel and compromising confidentiality. The failure to enforce the security configuration is identified as CWE‑693, improper control of privileged functions.

TP‑Link Systems Inc.’s Archer AXE75 V1 router model serves as the affected product; no other models or firmware versions are listed in the CVE data.

The CVSS score of 6.0 indicates a moderate impact, while the EPSS score of less than 1% suggests a very low probability of exploitation at the time of this assessment, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote VPN client connecting to the router to establish an L2TP session that bypasses IPSec protection. An attacker can use a standard L2TP client to open an unencrypted tunnel, exploiting the firmware’s failure to enforce the IPSec layer without needing special privileges on the router.