PT-2023-9013 · Tp Link · Eap225 V3

The Vulnerability · Published 2023-12-11 · Updated 2025-08-21 · CVE-2023-48724

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) version 5.1.0 Build 20220926

Description A memory corruption vulnerability exists in the web interface functionality, allowing an attacker to send an unauthenticated HTTP POST request to trigger this issue, leading to denial of service of the device's web interface. The vulnerability can be exploited by sending a specially crafted HTTP POST request.

Recommendations For Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) version 5.1.0 Build 20220926, as a temporary workaround, consider restricting access to the web interface until a patch is available. Avoid using the web interface functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2024-03015

CVE-2023-48724

Affected Products

Eap225 V3

References · 12

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1864 · Exploit
• https://bdu.fstec.ru/vul/2024-03015 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48724 · Security Note
• https://tp-link.com/us/support/download/eap225/v3/#Firmware · Note
• https://t.me/cvenotify/76165 · Telegram Post
• https://t.me/cvenotify/76187 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024041232 · Note
• https://twitter.com/cracbot/status/1777930873356030004 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1777736985269911966 · Twitter Post
• https://twitter.com/CVEnew/status/1777707971935699378 · Twitter Post
• https://t.me/cveNotify/133029 · Telegram Post