Buffer Overflow Vulnerability in Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)

CVE-2023-49906

Summary

A stack-based buffer overflow vulnerability is present in the web interface's Radio Scheduling feature of the Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point. Specifically, this vulnerability affects the EAP225 V3, version v5.1.0 Build 20220926. By sending a specially crafted series of HTTP requests that exploit the overflow in the ssid parameter, an attacker can achieve remote code execution. This flaw allows unauthorized control over the device by making authenticated HTTP requests that manipulate the httpd_portal binary at a specific offset. Immediate attention to this vulnerability is essential to protect against potential exploitation.

References