Vulnerability · Published Apr 9, 2024 · Assigned by talos
CVE-2023-49133
High 8.1
In plain English
A high-severity security flaw in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) from Tp-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities).
Official description
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts `uclited` on the EAP225(V3) 5.1.0 Build 20220926 of the AC1350 Wireless MU-MIMO Gigabit Access Point.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) | v5.1.0 Build 20220926 |
| Tp-Link | N300 Wireless Access Point (EAP115) | v5.0.4 Build 20220216 |
Weakness: CWE-829 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H