PT-2024-2143 · Tp Link · Tp-Link Archer C50

Hacefresko

+1

·

Published

2024-01-30

·

Updated

2024-09-23

·

CVE-2024-2188

CVSS v3.1

6.1

Medium

VectorAV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions TP-Link Archer AX50 version 1.0.11 build 2022052
Description The issue is related to a Cross-Site Scripting (XSS) vulnerability that could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule. This payload could be executed when the rule is loaded. The vulnerability is associated with the lack of protection for the web page structure, which could enable an attacker to execute arbitrary JavaScript code when a created port mapping rule is loaded.
Recommendations For TP-Link Archer AX50 version 1.0.11 build 2022052, consider disabling the SOAP request functionality that allows creating port mapping rules until a patch is available. Restrict access to the port mapping rule feature to minimize the risk of exploitation. Avoid using the vulnerable firmware version until an update is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-02052
CVE-2024-2188

Affected Products

Tp-Link Archer C50