High severity · published Apr 9, 2024
CVE-2023-48724
A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
A memory corruption vulnerability exists in the web interface functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted HTTP POST request can lead to denial of service of the device's web interface. An attacker can send an unauthenticated HTTP POST request to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AW
AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) · Tp-Link
v5.1.0 Build 20220926 · source: vendor
EF
Eap225 Firmware · Tp-link
5.1.0 · source: NVD
AF
Ac1350 Firmware · Tp-link
through v5.1.0 Build 20220926 · source: CISA
Affected product
AW
AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)
Tp-Link
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48724
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48724
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864
www.talosintelligence.com
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1864
More from AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)
9.8
CVE-2023-49134
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and…
9.8
CVE-2023-49133
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and…
8.8
CVE-2023-49913
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0…
8.8
CVE-2023-49912
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0…
8.8
CVE-2023-49911
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0…