PT-2021-23300 · Tp Link · Tp-Link Ax10V1

Published 2021-12-17 · Updated 2024-02-14 · CVE-2021-41451

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TP-Link AX10v1 versions prior to V1 211117

Description A misconfiguration in the HTTP/1.0 and HTTP/1.1 protocols of the web interface allows a remote unauthenticated attacker to send a specially crafted HTTP request and receive a misconfigured HTTP/0.9 response, potentially leading to a cache poisoning attack.

Recommendations For TP-Link AX10v1 versions prior to V1 211117, update to version V1 211117 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2021-41451

Affected Products

Tp-Link Ax10V1

References · 6

• https://osv.dev/vulnerability/CVE-2021-41451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41451 · Security Note
• http://ax10v1.com · Note
• https://t.me/cibsecurity/34196 · Telegram Post
• https://tp-link.com/us/support/download/archer-ax10/v1/#Firmware · Note
• http://tp-link.com · Note