CVE-2023-49134: Command Injection
A command execution vulnerability exists in the tddpd enabletestmode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially crafted series of network requests can lead to arbitrary command execution. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.This vulnerability impacts uclited on the EAP115(V4) 5.0.4 Build 20220216 of the N300 Wireless Gigabit Access Point.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49134?
CVE-2023-49134 has been classified as a critical severity vulnerability due to the potential for remote command execution.
How do I fix CVE-2023-49134?
To mitigate CVE-2023-49134, users should update affected devices to the latest firmware version as provided by Tp-Link.
What devices are affected by CVE-2023-49134?
CVE-2023-49134 affects the TP-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) and the TP-Link N300 Wireless Access Point (EAP115 V4).
What type of vulnerability is CVE-2023-49134?
CVE-2023-49134 is classified as a command execution vulnerability that allows unauthorized commands to be executed.
How was CVE-2023-49134 discovered?
CVE-2023-49134 was discovered through testing of the tddpd enable_test_mode functionality that processes specially crafted network requests.