Vulnerability · Published Mar 5, 2024 · Assigned by INCIBE
CVE-2024-2188Cross-Site Scripting vulnerability in TP-Link Archer AX50
Medium 6.1
In plain English
A medium-severity cross-site scripting in Archer AX50 from TP-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Official description
Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule, which could result in an execution of the JavaScript payload when the rule is loaded.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TP-Link | Archer AX50 | 1.0.11 build 2022052 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L