Tp-Link
Page 3 of 3 — Tp-Link CVEs from a corpus of 230, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-25139 | Critical | 10.0 | 2024-03-14 | In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffer overflow. After h… |
CVE-2023-43318 | High | 8.8 | 2024-03-06 | TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET r… |
CVE-2024-2188 | Medium | 6.1 | 2024-03-05 | Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unaut… |
CVE-2023-47618 | High | 7.2 | 2024-02-06 | A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47617 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230… |
CVE-2023-47209 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322… |
CVE-2023-47167 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Re… |
CVE-2023-46683 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0… |
CVE-2023-43482 | High | 7.2 | 2024-02-06 | A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 Rel.70591. A speci… |
CVE-2023-42664 | High | 7.2 | 2024-02-06 | A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 bui… |
CVE-2023-36498 | High | 7.2 | 2024-02-06 | A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322 R… |
CVE-2023-49515 | Medium | 4.6 | 2024-01-17 | Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to ob… |
CVE-2024-21833 | High | 8.8 | 2024-01-11 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, w… |
CVE-2024-21821 | High | 8.0 | 2024-01-11 | Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS command… |
CVE-2024-21773 | High | 8.8 | 2024-01-11 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS comma… |
CVE-2023-27098 | High | 7.5 | 2024-01-09 | TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. |
CVE-2023-34829 | Medium | 6.5 | 2023-12-28 | Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. |
CVE-2023-39610 | Medium | 6.5 | 2023-10-31 | An issue in TP-Link Tapo C100 v1.1.15 Build 211130 Rel.15378n(4555) and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted web… |
CVE-2023-46539 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle. |
CVE-2023-46538 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister. |
CVE-2023-46537 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister. |
CVE-2023-46536 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister. |
CVE-2023-46535 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister. |
CVE-2023-46534 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister. |
CVE-2023-46527 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function bindRequestHandle. |
CVE-2023-46526 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister. |
CVE-2023-46525 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister. |
CVE-2023-46523 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister. |
CVE-2023-46522 | Critical | 9.8 | 2023-10-25 | TP-LINK device TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the function deviceInfoR… |
CVE-2023-46521 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister. |
CVE-2023-46520 | Critical | 9.8 | 2023-10-25 | TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHandle. |
CVE-2023-46373 | Critical | 9.8 | 2023-10-25 | TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses. |
CVE-2023-46371 | Critical | 9.8 | 2023-10-25 | TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin. |
CVE-2023-42189 | High | 7.5 | 2023-10-10 | Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42… |
CVE-2023-38907 | High | 7.5 | 2023-09-25 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-43135 | Critical | 9.8 | 2023-09-20 | There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of t… |
CVE-2023-43138 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule… |
CVE-2023-43137 | High | 8.8 | 2023-09-20 | TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule n… |
CVE-2023-40531 | High | 8.0 | 2023-09-06 | Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS c… |
CVE-2023-40357 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer A… |
CVE-2023-40193 | High | 8.0 | 2023-09-06 | Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39935 | High | 8.0 | 2023-09-06 | Archer C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-39224 | High | 8.0 | 2023-09-06 | Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated attacker to execute a… |
CVE-2023-38588 | High | 8.0 | 2023-09-06 | Archer C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent authenticated attacker to execute arbitrary OS commands. |
CVE-2023-38568 | High | 8.8 | 2023-09-06 | Archer A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands. |
CVE-2023-38563 | High | 8.8 | 2023-09-06 | Archer C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)_V3_230508' allow a network-adjacen… |
CVE-2023-37284 | High | 8.8 | 2023-09-06 | Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)_V1_230616' allows a network-adjacent unauthenticated attacker to… |
CVE-2023-36489 | High | 8.8 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR8… |
CVE-2023-32619 | High | 8.8 | 2023-09-06 | Archer C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)_V1_230506' use hard-coded credential… |
CVE-2023-31188 | High | 8.0 | 2023-09-06 | Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer C… |
CVE-2023-38909 | Medium | 6.5 | 2023-08-22 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-38908 | Medium | 6.5 | 2023-08-22 | An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a rem… |
CVE-2023-38906 | Medium | 6.5 | 2023-08-22 | An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 al… |
CVE-2023-39751 | Critical | 9.8 | 2023-08-21 | TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm. |
CVE-2023-39748 | High | 7.5 | 2023-08-21 | An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. |
CVE-2023-39747 | Critical | 9.8 | 2023-08-21 | TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at /userRpm/WlanSecurity… |
CVE-2023-39745 | High | 7.5 | 2023-08-21 | TP-Link TL-WR940N V2, TP-Link TL-WR941ND V5 and TP-Link TL-WR841N V8 were discovered to contain a buffer overflow via the component /userRpm/AccessCtrlAccessRu… |
CVE-2023-31710 | Critical | 9.8 | 2023-08-01 | TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow. |
CVE-2023-30383 | High | 7.5 | 2023-07-18 | TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Archer_C2_US__V1_170228 were discovered to co… |
CVE-2023-36359 | High | 7.5 | 2023-06-22 | TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /userRpm/QoSRuleList… |
CVE-2023-36358 | High | 7.7 | 2023-06-22 | TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overflow in the component /userRpm/AccessCtrlA… |
CVE-2023-36357 | High | 7.7 | 2023-06-22 | An issue in the /userRpm/LocalManageControlRpm component of TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8/V10, and TL-WR941ND V5 allows attackers to cause a Denial… |
CVE-2023-36356 | High | 7.7 | 2023-06-22 | TP-Link TL-WR940N V2/V4/V6, TL-WR841N V8, TL-WR941ND V5, and TL-WR740N V1/V2 were discovered to contain a buffer read out-of-bounds via the component /userRpm/… |
CVE-2023-36355 | Critical | 9.9 | 2023-06-22 | TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. This vulnerability allows attacker… |
CVE-2023-36354 | High | 7.5 | 2023-06-22 | TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR740N V1/V2, TL-WR940N V2/V3, and TL-WR941ND V5/V6 were discovered to contain a buffer overflow in the component /u… |
CVE-2023-34832 | Critical | 9.8 | 2023-06-16 | TP-Link Archer AX10(EU)_V1.2_230220 was discovered to contain a buffer overflow via the function FUN_131e8 - 0x132B4. |
CVE-2023-29562 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA7510 (EU)_V2_190125 was discovered to contain a stack overflow via the operation parameter at /admin/locale. |
CVE-2023-27836 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the devicePwd parameter in the function sub_ 40A80… |
CVE-2023-27837 | Critical | 9.8 | 2023-06-13 | TP-Link TL-WPA8630P (US)_ V2_ Version 171011 was discovered to contain a command injection vulnerability via the key parameter in the function sub_ 40A774. |
CVE-2023-28478 | High | 8.8 | 2023-06-12 | TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow. |
CVE-2023-33538 | High | 8.8 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetwo… |
CVE-2023-33537 | High | 8.1 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMapCfgRpm. |
CVE-2023-33536 | High | 8.1 | 2023-06-07 | TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/WlanMacFilterRpm. |
CVE-2023-27126 | Medium | 4.6 | 2023-06-06 | The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physica… |
CVE-2023-31756 | Medium | 6.7 | 2023-05-19 | A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0. 0.9.1 v5006.0 B… |
CVE-2023-31701 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove. |
CVE-2023-31700 | High | 8.8 | 2023-05-17 | TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd. |
CVE-2023-2646 | Medium | 4.5 | 2023-05-11 | A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2022-37255 | High | 7.5 | 2023-04-16 | TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. |
CVE-2023-28368 | Medium | 5.7 | 2023-04-11 | TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake device may be prepared… |
CVE-2022-43636 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authe… |
CVE-2022-43635 | Medium | 6.5 | 2023-03-29 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) route… |
CVE-2022-42433 | High | 8.0 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers… |
CVE-2022-24973 | High | 8.0 | 2023-03-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5… |
CVE-2022-24972 | Medium | 6.5 | 2023-03-28 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.3… |
CVE-2022-24353 | High | 8.8 | 2023-03-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 1.1.4 Build 20211022 rel.59103(5553)… |
CVE-2022-24352 | High | 8.8 | 2023-03-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 211210 routers. Authenticat… |
CVE-2022-0650 | High | 8.0 | 2023-03-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5… |
CVE-2023-27078 | Critical | 9.8 | 2023-03-23 | A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted request to the tftp… |
CVE-2023-1389 | High | 8.8 | 2023-03-15 | TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci… |
CVE-2023-23040 | High | 7.5 | 2023-02-22 | TP-Link router TL-WR940N V6 3.19.1 Build 180119 uses a deprecated MD5 algorithm to hash the admin password used for basic authentication. |
CVE-2023-0936 | Medium | 6.5 | 2023-02-21 | A vulnerability was found in TP-Link Archer C50 V2_160801. It has been rated as problematic. Affected by this issue is some unknown functionality of the compon… |
CVE-2022-41505 | Medium | 6.4 | 2023-01-23 | An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interruptin… |
CVE-2021-37774 | High | 8.0 | 2023-01-19 | An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code. |
CVE-2023-22303 | Critical | 9.8 | 2023-01-17 | TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certain conditions, an a… |
CVE-2022-4498 | Critical | 9.8 | 2023-01-11 | In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafte… |
CVE-2022-4499 | High | 7.5 | 2023-01-11 | TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-chann… |
CVE-2022-48194 | High | 8.8 | 2022-12-30 | TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a cr… |
CVE-2022-46914 | High | 8.8 | 2022-12-20 | An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial… |
CVE-2022-46912 | High | 8.8 | 2022-12-20 | An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of… |