Name of the Vulnerable Software and Affected Versions:

TP-Link AX10 versions prior to 1.2.1

TP-Link AX1500 versions prior to 1.3.11

Description:

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the affected devices. Exploitation requires a Man-In-The-Middle (MITM) attack. The vulnerability is due to a buffer copy without proper input size validation.

Recommendations:

TP-Link AX10 versions prior to 1.2.1: Update to version 1.2.1 or later.

TP-Link AX1500 versions prior to 1.3.11: Update to version 1.3.11 or later.