PT-2021-5992 · Tp Link · Tp-Link Ax10V1

Published 2021-09-20 · Updated 2024-02-14 · CVE-2021-41450

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TP-Link AX10v1 versions prior to v1 211117

Description The issue is related to a deficiency in handling HTTP requests, which can be exploited by a remote unauthenticated attacker to conduct an HTTP request smuggling attack. This can lead to a Denial of Service (DoS) of the web application via sending a specific HTTP packet. The attack allows a remote attacker to send a hidden HTTP request.

Recommendations For TP-Link AX10v1 versions prior to v1 211117, update to version v1 211117 or later to resolve the issue. As a temporary workaround, consider restricting access to the web application to minimize the risk of exploitation.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2022-00512

CVE-2021-41450

Affected Products

Tp-Link Ax10V1

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-41450 · Security Note
• https://bdu.fstec.ru/vul/2022-00512 · Security Note
• http://tp-link.com · Vendor Advisory
• https://tp-link.com/us/support/download/archer-ax10/v1/#Firmware · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41450 · Vendor Advisory
• https://vuldb.com/?id.187780 · Note
• https://tp-link.com/ru/support/download/archer-ax10/v1/#Firmware · Note
• http://ax10v1.com · Note
• https://t.me/cibsecurity/33591 · Telegram Post