Web Application Vulnerability in TP-Link AX10 Router
CVE-2022-41540
5.9MEDIUM
Key Information:
- Vendor
Tp-link
- Status
- Vendor
- CVE Published:
- 18 October 2022
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2022-41540?
The TP-Link AX10 web application client employs hard-coded cryptographic keys for communications with the router. This flaw allows attackers to exploit man-in-the-middle scenarios, gaining the ability to intercept and access sensitive data. By executing a brute-force attack, adversaries can decipher the hard-coded sequence key, potentially compromising user information transmitted between the client and router.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.