PT-2022-6525 · Tp Link · Tp-Link Archer Ax21

Kevin Wang · Published 2022-12-28 · Updated 2025-08-06 · CVE-2023-27346

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link Archer AX21 (AX1800) (affected versions not specified)

Description The issue is related to a buffer overflow vulnerability in the TP-Link AX1800 router's firmware, allowing remote attackers to execute arbitrary code on affected installations. The flaw exists within the parsing of firmware images due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. This can be leveraged to execute code in the context of root. Authentication is not required to exploit this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2023-01986

CVE-2023-27346

ZDI-23-377

Affected Products

Tp-Link Archer Ax21

References · 6

• https://osv.dev/vulnerability/CVE-2023-27346 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-377 · Security Note
• https://bdu.fstec.ru/vul/2023-01986 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-27346 · Security Note
• https://t.me/cveNotify/131074 · Telegram Post
• https://tp-link.com/us/support/download/archer-ax21/v3/#Firmware · Note