---METADATA---
VENDOR: TP-Link
PRODUCT: Kasa EC71 v4 and EC70 v4
AFFECTED_VERSIONS: 0 up to (excluding) 2.4.0 Build 20260520 rel.4191
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Kasa EC71 and EC70 v4 firmware versions store a static cryptographic private key on a read-only filesystem, which is shared across all devices.

Executive Summary:
The presence of a hard-coded, static cryptographic key across TP-Link Kasa devices introduces a critical risk of interception and unauthorized access to device communications.

Vulnerability Details

CVE-ID: CVE-2026-9770

Affected Software: TP-Link Kasa EC71 v4 and EC70 v4

Affected Versions: All versions prior to 2.4.0 Build 20260520 rel.4191

Vulnerability: This vulnerability (CWE-321) involves the use of hard-coded cryptographic keys, which enables an attacker with adjacent network access to potentially decrypt communications or impersonate legitimate devices.

Business Impact

The use of a shared static key undermines the security of the entire device fleet. A successful exploit could lead to the complete compromise of device confidentiality and integrity, effectively nullifying the encryption intended to protect user traffic and device management commands.

Remediation Plan

Immediate Action: Update the firmware of all Kasa EC71 and EC70 v4 devices to version 2.4.0 Build 20260520 rel.4191 or later, as provided by the TP-Link support portal.

Proactive Monitoring: Monitor the local network for unusual authentication requests or attempts to intercept traffic originating from smart home devices.

Compensating Controls: Isolate smart home devices onto a dedicated VLAN to limit the scope of potential lateral movement or interception attempts from compromised devices on the primary network.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Hard-coded keys represent a systemic flaw in product design, making them inherently exploitable once the key is extracted.

Analyst Recommendation

Due to the nature of hard-coded credentials, this vulnerability poses a significant risk to the privacy and security of the affected hardware. Users should ensure the firmware update is applied immediately to rotate or replace the insecure cryptographic material.

---METADATA---
VENDOR: TP-Link
PRODUCT: AXE75 V1
AFFECTED_VERSIONS: 0 up to (excluding) 1.5.6 Build 20260623
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link AXE75 V1 routers are susceptible to OS command injection in the VPN module, enabling remote code execution by high-privileged users.

Executive Summary:
A high-severity OS command injection vulnerability in the VPN module of TP-Link AXE75 V1 routers enables attackers with high privileges to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-9044

Affected Software: TP-Link AXE75 V1

Affected Versions: 0 up to (excluding) 1.5.6 Build 20260623

Vulnerability: This is an OS command injection vulnerability (CWE-78) located within the VPN module. It requires high-privileged (administrator) access to successfully exploit, allowing the execution of arbitrary system commands.

Business Impact

With a CVSS score of 8.5, this vulnerability represents a significant risk to network infrastructure. If exploited, an attacker could gain full control over the router, potentially leading to complete network compromise, interception of traffic, or the deployment of persistent threats within the local network.

Remediation Plan

Immediate Action: Update the router firmware to version 1.5.6 Build 20260623 or later.

Proactive Monitoring: Monitor the router logs for signs of unauthorized configuration changes or unusual outbound traffic patterns indicative of command injection.

Compensating Controls: Restrict administrative access to the router interface to trusted IP addresses only and disable remote management features if they are not required.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires administrative access, the potential for total device takeover makes it a critical concern for network security.

Analyst Recommendation

Network administrators must ensure that all TP-Link AXE75 V1 devices are updated immediately. Given that command injection can lead to full system compromise, patching is the only effective way to mitigate this risk.

---METADATA---
VENDOR: TP-Link
PRODUCT: Archer C64
AFFECTED_VERSIONS: Archer C64 v1
---END_METADATA---

Description Summary:
A lack of rate-limiting on the debug SSH service of the Archer C64 v1 router allows attackers to brute-force credentials, leading to full administrative access.

Executive Summary:
A critical authentication vulnerability in the TP-Link Archer C64 v1 allows attackers to brute-force SSH credentials and gain full administrative control.

Vulnerability Details

CVE-ID: CVE-2026-8697

Affected Software: TP-Link Archer C64 v1

Affected Versions: Archer C64 v1

Vulnerability: The debug SSH service fails to enforce rate-limiting on authentication attempts. Furthermore, it shares credentials with the web interface, allowing an attacker with adjacent network access to brute-force the password and gain administrative privileges.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to network security. An attacker who gains administrative access to a gateway device can intercept traffic, modify DNS settings, or establish a permanent backdoor into the internal network, leading to complete compromise of the connected environment.

Remediation Plan

Immediate Action: Update the Archer C64 firmware to version 1.15.0 Build 250729 Rel.63489n(4555) or later to enforce proper rate-limiting.

Proactive Monitoring: Monitor for unusual SSH activity and failed login attempts originating from the local network, which may indicate brute-force activity.

Compensating Controls: Disable SSH access on the device if it is not strictly required for administrative operations, and utilize strong, unique passwords for the web interface.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of June 4, 2026, public exploit scripts are available. Given the ease of exploitation, this represents a significant risk to the security of the internal network.

Analyst Recommendation

The ease of exploitation via simple scripts makes this a critical threat. Users must apply the specified firmware update immediately to secure the SSH service and protect the device from unauthorized administrative access.

---METADATA---
VENDOR: TP-Link
PRODUCT: Range Extenders
AFFECTED_VERSIONS: multiple TP-Link range extenders, including Archer Re305 V1, Archer Re360 V1, Archer Re650 V1 and 12 more
---END_METADATA---

Description Summary:
An authentication logic vulnerability in TP-Link range extenders allows unauthenticated attackers on an adjacent network to reset administrator passwords.

Executive Summary:
A critical authentication logic vulnerability in various TP-Link range extenders allows unauthenticated attackers to hijack administrative control over affected devices.

Vulnerability Details

CVE-ID: CVE-2026-3294

Affected Software: TP-Link Range Extenders

Affected Versions: multiple TP-Link range extenders, including Archer Re305 V1, Archer Re360 V1, Archer Re650 V1 and 12 more

Vulnerability: This is an authentication logic vulnerability (CWE-20) where insufficient validation allows an unauthenticated attacker on an adjacent network to manipulate login parameters. Successful exploitation results in an unauthorized administrator password reset, granting the attacker full control over the device.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a significant security risk. Successful exploitation allows an attacker to gain full administrative access to range extenders, potentially enabling them to intercept network traffic, modify DNS settings, or pivot into the internal network, leading to severe data compromise and loss of network integrity.

Remediation Plan

Immediate Action: Update the affected TP-Link range extenders to the latest firmware version provided by the vendor.

Proactive Monitoring: Review device access logs for unusual login attempts or unauthorized password reset events.

Compensating Controls: Restrict access to the management interface of the range extenders to trusted administrative IP addresses only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 2, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the ability for an unauthenticated attacker to gain full control, immediate attention is required. Administrators should verify their specific device models against the vendor's advisory and apply the latest firmware updates as soon as they become available to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: TP-Link
PRODUCT: TL-WR940N v6
AFFECTED_VERSIONS: TL-WR940N v6: 0 up to (excluding) (US)_V6_260528, (JP)_V6_260527, (EU)_V6_260528
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The TP-Link TL-WR940N v6 router contains a stack-based buffer overflow vulnerability in its RTSP connection tracking module.

Executive Summary:
A stack-based buffer overflow vulnerability in the TP-Link TL-WR940N v6 router allows unauthenticated remote attackers to potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-12935

Affected Software: TP-Link TL-WR940N v6

Affected Versions: TL-WR940N v6: 0 up to (excluding) (US)_V6_260528, (JP)_V6_260527, (EU)_V6_260528

Vulnerability: This vulnerability exists in the RTSP connection tracking module, where improper handling of network traffic can trigger a stack-based buffer overflow. The attack is unauthenticated, though it requires user interaction to facilitate the exploitation process.

Business Impact

Successful exploitation of this buffer overflow allows for the potential execution of arbitrary code with high privileges. This risk, reflected by a high CVSS score of 8.7, could result in complete device compromise, unauthorized network access, and the potential for the router to be recruited into botnets or used as a pivot point for further internal network attacks.

Remediation Plan

Immediate Action: Update the firmware of the affected TL-WR940N v6 devices to the latest versions: (US)_V6_260528, (JP)_V6_260527, or (EU)_V6_260528, depending on the regional model.

Proactive Monitoring: Monitor device logs for unusual system crashes, unexpected reboots, or RTSP traffic patterns that deviate from established operational baselines.

Compensating Controls: Restrict access to the router management interface and disable unnecessary RTSP features if they are not required for specific network applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 30, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of buffer overflows allowing memory corruption, which typically leads to remote code execution.

Analyst Recommendation

Given the high severity and potential for total system compromise, administrators must prioritize the application of the vendor-supplied firmware updates. Ensure all regional variants are updated to the specified versions to eliminate the vulnerability and secure the network perimeter.

---METADATA---
VENDOR: TP-Link
PRODUCT: Archer MR200
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability exists in the DHCP option processing logic of multiple TP-Link router models due to insufficient validation of externally supplied data.

Executive Summary:
A high-severity command injection vulnerability in TP-Link Archer MR200 routers allows unauthenticated attackers to execute arbitrary code via malicious DHCP traffic.

Vulnerability Details

CVE-ID: CVE-2026-11834

Affected Software: TP-Link Archer MR200

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a command injection flaw occurring within the DHCP option processing logic. The vulnerability is exploitable by an unauthenticated attacker who can send specially crafted DHCP packets to the target device.

Business Impact

With a CVSS score of 8.7, this vulnerability poses a severe threat to network security. Successful exploitation grants an attacker full control over the router, enabling them to intercept traffic, redirect users to malicious sites, or use the device as a pivot point for further lateral movement within the internal network.

Remediation Plan

Immediate Action: Update router firmware to the latest version provided by TP-Link immediately to remediate the vulnerable DHCP processing logic.

Proactive Monitoring: Monitor network traffic for unusual DHCP handshake patterns or unexpected command execution attempts originating from network devices.

Compensating Controls: Disable unnecessary features such as remote management and place vulnerable hardware behind a secondary firewall if immediate firmware updates cannot be applied.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is particularly dangerous as it allows unauthenticated remote code execution on network infrastructure. IT administrators must prioritize firmware updates for all affected TP-Link devices to prevent potential network-wide compromise and unauthorized access.

---METADATA---
VENDOR: TP-Link
PRODUCT: Omada Gateways
AFFECTED_VERSIONS: TP-Link Omada Gateways, Omada Switches, and Omada Access Points
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A certificate validation weakness in the communication between TP-Link Omada devices and cloud controllers enables potential interception of traffic.

Executive Summary:
Improper certificate validation in TP-Link Omada cloud-managed devices could allow an attacker to intercept or manipulate traffic between local devices and the cloud controller.

Vulnerability Details

CVE-ID: CVE-2025-9291

Affected Software: TP-Link Omada Gateways, Switches, and Access Points

Affected Versions: TP-Link Omada Gateways, Omada Switches, and Omada Access Points

Vulnerability: This vulnerability (CWE-295) stems from a failure to properly validate certificates during the communication handshake between network hardware and cloud management controllers. The attack requires network access and specific conditions (AC:H), but it does not require authentication.

Business Impact

The CVSS score of 7.7 (High) underscores the risk of losing communication integrity with cloud-managed infrastructure. If exploited, an attacker could perform man-in-the-middle attacks, potentially leading to unauthorized commands being issued to network devices or the theft of sensitive configuration data.

Remediation Plan

Immediate Action: Update all affected Omada devices to the latest firmware versions by following the instructions provided in the Omada download center.

Proactive Monitoring: Monitor cloud-to-device communication logs for unauthorized connection attempts or certificate validation errors.

Compensating Controls: Use encrypted VPN tunnels for management traffic if the native cloud communication channel is deemed untrusted until patches are applied.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is a classic certificate validation failure, making the encrypted channel susceptible to interception.

Analyst Recommendation

Organizations relying on Omada cloud management must treat this as a high-priority update. Promptly installing the latest firmware will address the certificate validation weakness and secure the management path against potential interception attacks.

---METADATA---
VENDOR: TP-Link
PRODUCT: Aginet HB810, HB710, HB610
AFFECTED_VERSIONS: See enrichment data for specific build versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Aginet devices are susceptible to OS command injection due to improper input validation in web interface components.

Executive Summary:
A critical OS command injection vulnerability in TP-Link Aginet devices allows authenticated users to execute arbitrary system-level commands.

Vulnerability Details

CVE-ID: CVE-2025-30241

Affected Software: TP-Link Aginet HB810, HB710, and HB610 series

Affected Versions: Various build versions prior to 0.9.0, 0.10.0, 0.3.0, and 0.6.0 releases

Vulnerability: The web interface fails to sanitize user-supplied input before passing it to system-level command execution functions (CWE-78). This allows an authenticated attacker to inject malicious commands into the underlying operating system.

Business Impact

Successful exploitation grants an attacker the ability to execute arbitrary commands with system-level privileges, leading to full device compromise. This poses a severe threat to data confidentiality and network integrity, consistent with the high CVSS score of 8.6, and could facilitate further lateral movement into the connected network.

Remediation Plan

Immediate Action: Apply the latest firmware updates released by TP-Link to patch the vulnerable web interface components.

Proactive Monitoring: Inspect system logs for unusual command execution patterns or unauthorized modifications to system configuration files.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent inspection mechanism to block malicious input patterns directed at the device management interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of command injection flaws makes them highly attractive to attackers, necessitating prompt remediation.

Analyst Recommendation

Command injection is a high-risk vulnerability that can lead to complete system takeover. Organizations using these TP-Link devices must treat the vendor firmware patch as a critical update and deploy it immediately to prevent potential remote code execution.

---METADATA---
VENDOR: TP-Link
PRODUCT: Aginet HB810, HB710, HB610
AFFECTED_VERSIONS: See enrichment data for specific build versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Aginet devices use hardcoded cryptographic keys in their firmware, potentially allowing unauthorized decryption of sensitive configuration data.

Executive Summary:
The presence of hardcoded cryptographic keys in TP-Link Aginet firmware creates a risk of sensitive configuration data exposure and decryption.

Vulnerability Details

CVE-ID: CVE-2025-30239

Affected Software: TP-Link Aginet HB810, HB710, and HB610 series

Affected Versions: Various build versions prior to 0.9.0, 0.10.0, 0.3.0, and 0.6.0 releases

Vulnerability: The firmware contains hardcoded cryptographic keys (CWE-321) used to protect configuration data. An attacker with access to the device storage can extract these keys to decrypt sensitive information stored on the device.

Business Impact

Exposure of configuration data, such as credentials or network settings, can lead to severe security breaches, including unauthorized network access and persistent compromise. With a CVSS score of 8.5, this vulnerability significantly undermines the confidentiality of the device, increasing the risk of wider organizational compromise.

Remediation Plan

Immediate Action: Update firmware to the versions provided by the vendor, which address the improper handling of cryptographic keys.

Proactive Monitoring: Monitor for unauthorized attempts to access or dump device storage or configuration files.

Compensating Controls: Ensure physical access to hardware is restricted and disable unnecessary management features to limit the potential for local storage extraction.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires some level of device access, the inclusion of hardcoded keys is a fundamental security failure that must be addressed.

Analyst Recommendation

Hardcoded keys represent a permanent weakness in the security architecture of the affected devices. It is imperative that security teams apply the provided vendor patches to ensure that configuration data is protected by secure, unique, and non-hardcoded cryptographic mechanisms.

---METADATA---
VENDOR: TP-Link
PRODUCT: Aginet HB810, HB710, HB610
AFFECTED_VERSIONS: See enrichment data for specific build versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Aginet devices contain an authorization bypass vulnerability allowing authenticated low-privileged users to perform unauthorized administrative actions.

Executive Summary:
A high-severity authorization flaw in TP-Link Aginet devices permits low-privileged users to escalate their access and perform restricted administrative operations.

Vulnerability Details

CVE-ID: CVE-2025-30238

Affected Software: TP-Link Aginet HB810, HB710, and HB610 series

Affected Versions: Various build versions prior to 0.9.0, 0.10.0, 0.3.0, and 0.6.0 releases

Vulnerability: This vulnerability involves improper authorization checks (CWE-863) within the device firmware. An authenticated user with low privileges can bypass intended security constraints to invoke functions reserved for administrators.

Business Impact

The ability for a low-privileged user to execute administrative tasks compromises the entire security posture of the affected network device. Successful exploitation leads to full administrative control, potentially allowing for configuration changes, network monitoring, or the disabling of security features, with a CVSS score of 8.6 indicating a significant risk to organizational infrastructure.

Remediation Plan

Immediate Action: Update the affected TP-Link Aginet devices to the firmware versions specified in the vendor security advisory.

Proactive Monitoring: Audit system logs for unexpected administrative changes or unauthorized access attempts originating from standard user accounts.

Compensating Controls: Restrict management interface access to trusted, dedicated management VLANs to minimize the exposure of administrative functions to unauthorized users.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation within the device management interface.

Analyst Recommendation

This vulnerability presents a substantial risk to the integrity of network hardware. Administrators must prioritize the application of firmware updates provided by TP-Link to remediate this authorization flaw and prevent unauthorized administrative access.

---METADATA---
VENDOR: TP-Link
PRODUCT: Aginet devices
AFFECTED_VERSIONS: See enrichment data for specific HB series models and build versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced, allowing unauthenticated access.

Executive Summary:
A critical authentication bypass vulnerability in TP-Link Aginet devices allows unauthenticated attackers to gain administrative control over the web management interface.

Vulnerability Details

CVE-ID: CVE-2025-30237

Affected Software: TP-Link Aginet devices (HB810, HB710, HB610 series)

Affected Versions: See vendor advisory for specific model build versions.

Vulnerability: This is a missing authorization vulnerability (CWE-862) occurring within the web management interface. An unauthenticated attacker can access sensitive endpoints without providing valid credentials, effectively bypassing the device's primary security barrier.

Business Impact

The CVSS score of 8.7 highlights the severity of this issue, as it permits full administrative control over network infrastructure devices. Unauthorized access to these devices can result in total network compromise, allowing an attacker to intercept traffic, modify configurations, or pivot into the internal network, causing significant operational and security risks.

Remediation Plan

Immediate Action: Identify if your device firmware version matches the affected range and apply the latest security update from the TP-Link support website.

Proactive Monitoring: Audit network management traffic for connections to the web interface from unauthorized or unexpected IP addresses.

Compensating Controls: Disable remote management of the web interface from the WAN side and restrict access to the management console to a dedicated, secure management VLAN.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this flaw makes it highly attractive for automated exploitation attempts against internet-facing devices.

Analyst Recommendation

Given that this vulnerability affects network hardware, the risk of lateral movement is extremely high. Device administrators must prioritize updating firmware to the latest version immediately and ensure that these devices are not exposed directly to the public internet.

---METADATA---
VENDOR: TP-Link
PRODUCT: Omada Gateways
AFFECTED_VERSIONS: TP-Link Omada Controllers, Omada Gateways, Omada Switches, Omada Access Points, and Omada OLTs
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
TP-Link Omada devices use shared embedded certificates to establish trust between controllers and managed devices, creating a risk of unauthorized impersonation.

Executive Summary:
A vulnerability in TP-Link Omada devices involving hard-coded, shared certificates allows potential attackers to impersonate trusted network components and intercept communications.

Vulnerability Details

CVE-ID: CVE-2025-15628

Affected Software: TP-Link Omada Gateways, Controllers, Switches, Access Points, and OLTs

Affected Versions: TP-Link Omada Controllers, Omada Gateways, Omada Switches, Omada Access Points, and Omada OLTs

Vulnerability: This vulnerability (CWE-798) involves the use of hard-coded, shared embedded certificates across different deployments. The attack vector is adjacent (AV:A), meaning an attacker must be on the same local network segment to exploit the flaw, but no authentication is required.

Business Impact

The CVSS score of 8.2 (High) reflects the significant risk posed by the ability to intercept sensitive management traffic. Successful exploitation could lead to the compromise of network integrity, as an attacker could masquerade as a legitimate controller to push unauthorized configurations or capture sensitive data moving across the management plane.

Remediation Plan

Immediate Action: Update all affected Omada devices to the latest firmware versions available via the official TP-Link Omada download center.

Proactive Monitoring: Monitor network access logs for anomalous controller-to-device communication patterns or unexpected certificate handshake failures.

Compensating Controls: Segment management traffic on a dedicated, isolated VLAN to restrict unauthorized access to the management plane.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on shared certificates is a fundamental design flaw that makes these devices susceptible to man-in-the-middle attacks if an attacker gains access to the local network.

Analyst Recommendation

Given the high severity of this vulnerability, administrators should prioritize updating all Omada infrastructure components immediately. Addressing this flaw is essential to maintaining the trust relationship between controllers and managed hardware and preventing potential network-wide compromise.

Executive Summary:
A high-severity vulnerability exists in multiple TP-Link router products, including the Archer AX21 model. An unauthenticated attacker on the local network can exploit this flaw to execute arbitrary code with the highest privileges (root), allowing them to take complete control of the affected device. This could lead to network traffic interception, pivoting to other internal systems, or complete disruption of network services.

Vulnerability Details

CVE-ID: CVE-2023-28760

Affected Software: TP-Link Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a command injection flaw within the MiniDLNA service running on affected TP-Link routers. An unauthenticated attacker with access to the Local Area Network (LAN) can send a specially crafted request to the device. By manipulating the db_dir field in this request, the attacker can inject and execute arbitrary operating system commands, which are run with root-level permissions, granting them full administrative control over the router.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.5. Successful exploitation would result in a complete compromise of the network perimeter device. An attacker could intercept, monitor, or redirect all internet traffic, leading to data theft of sensitive information. The compromised router could also be used as a pivot point to launch further attacks against other devices on the internal network, or be conscripted into a botnet for use in external attacks like Distributed Denial-of-Service (DDoS), causing reputational damage and potential service disruption.

Remediation Plan

Immediate Action: Apply the security updates provided by TP-Link to all affected devices immediately. After patching, review device access logs and system logs for any unusual activity or connections related to the minidlnad service that may indicate a prior compromise.

Proactive Monitoring: Monitor network traffic for unusual patterns originating from the router itself, such as connections to unknown external IP addresses. System administrators should check for unexpected processes, high CPU utilization, or unauthorized configuration changes on the device. Log analysis should focus on requests to the minidlnad service, specifically looking for malformed or suspicious values in the db_dir parameter.

Compensating Controls: If patching is not immediately possible, disable the DLNA Media Server feature via the router's web administration interface, as this will deactivate the vulnerable minidlnad service. Additionally, implement network segmentation to restrict access to the router's management interface and other services from non-essential parts of the network.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of October 2, 2025, proof-of-concept (PoC) exploit code for this vulnerability is publicly available, significantly lowering the barrier for threat actors to develop and launch attacks. The primary mitigating factor is that the attacker must have prior access to the local network (e.g., via a compromised endpoint or by being connected to the Wi-Fi). However, once on the LAN, the attack is unauthenticated and provides complete control, making it a critical internal threat.

Analyst Recommendation

Given the high severity (CVSS 7.5), root-level impact, and the availability of public exploit code, we recommend that organizations treat this vulnerability with high urgency. All affected TP-Link devices should be identified and patched immediately. Although this CVE is not currently listed on the CISA KEV list, its characteristics make it a prime target for attackers who have gained an initial foothold in a network. If patching cannot be performed, the recommended compensating controls, particularly disabling the DLNA service, must be implemented as a temporary measure.