PT-2025-16880 · Tp Link · Tp-Link Eap120

Theveteran1 · Published 2025-04-10 · Updated 2025-04-24 · CVE-2025-29648

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TP-Link EAP120 router version 1.0

Description A SQL Injection vulnerability exists in the TP-Link EAP120 router's login dashboard, allowing an unauthenticated attacker to inject malicious SQL statements via the login fields. Note that this issue is disputed because it can only be reproduced on a supplier-provided emulator, where access control is intentionally absent for ease of functional testing.

Recommendations For version 1.0, consider disabling the login functionality until a patch is available to prevent exploitation of the SQL Injection vulnerability. Restrict access to the login dashboard to minimize the risk of exploitation. Avoid using the login fields in the affected dashboard until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-05220

CVE-2025-29648

Affected Products

Tp-Link Eap120

References · 12

• 🔥 https://github.com/TheVeteran1/Vulnerability-Research/blob/main/CVE-2025-29648 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-29648 · Security Note
• https://bdu.fstec.ru/vul/2025-05220 · Security Note
• https://twitter.com/CVEnew/status/1913823763742797914 · Twitter Post
• https://t.me/cvedetector/23185 · Telegram Post
• https://t.me/cvenotify/119616 · Telegram Post
• https://t.me/cvenotify/119643 · Telegram Post
• https://twitter.com/dailycve/status/1915409031214121006 · Twitter Post
• https://twitter.com/cybercronai/status/1912876422030414130 · Twitter Post
• https://twitter.com/syedaquib77/status/1915016468149813467 · Twitter Post
• https://t.me/cvetracker/21793 · Telegram Post
• https://twitter.com/CVETracker/status/1912959433346306535 · Twitter Post