CVE-2024-2188: Cross-Site Scripting vulnerability in TP-Link Archer AX50

Published Mar 5, 2024

Updated

Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule, which could result in an execution of the JavaScript payload when the rule is loaded.

Affected Software

3 affected components

TP-Link Archer AX50

All of the following

TP-Link Archer AX50 firmware=1.0.11

TP-Link Archer AX50

Remediation

Information

Update the firmware to Archer AX50(EU)_V1_1.0.14 build 20240108.

Event History

Mar 5, 2024

CVE Published

via MITRE·12:15 PM

Data Sourced

via MITRE·12:15 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-2188?

CVE-2024-2188 has been classified as a high-severity Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2024-2188?

To mitigate CVE-2024-2188, update the firmware of the TP-Link Archer AX50 to version 1.0.11 or later.

What products are affected by CVE-2024-2188?

CVE-2024-2188 affects the TP-Link Archer AX50 with firmware version 1.0.11 build 2022052.

What type of vulnerability is CVE-2024-2188?

CVE-2024-2188 is a Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts.

Can CVE-2024-2188 be exploited remotely?

Yes, CVE-2024-2188 can be exploited by unauthenticated attackers remotely through a SOAP request.