2041 matches found
CVE-2023-1389
TP-Link Archer AX21 - Unauthenticated Command Injection Loader POC CVE-2023-1389 Exploit Title: TP-Link Archer AX21 - Unauthenticated Command Injection Date Found : 07/25/2023 Exploit Author: Voyag3r root@kitploit: How to Use :- Scanning - Use Zmap : zmap -p 80 -o list.txt NetCat Listener - apt...
cve-2020-9375
CVE-2020-9375 TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field. Exploit Title : TP-Link Archer C50 v3 Denial of Service Date : 25-01-2020 Exploit Author : thewhiteh4t...
CVE-2026-9254
TP-Link Archer BE800 V1 — Parental Control LAN RCE CVE: CVE-2026-9254 CVSS: 8.7 High Auth required: None Network position: LAN only Found on version 1.3.2 Build 20251015 rel.106595553 Summary The parental control blocking endpoint /cgi-bin/luci/blocking?form=vercode is reachable from the LAN...
CVE-2020-10882
Enlaces de referencia https://www.zerodayinitiative.com/blog/2020/4/6/exploiting-the-tp-link-archer-c7-at-pwn2own-tokyo https://github.com/rdomanski/ExploitsandAdvisories/blob/master/advisories/Pwn2Own/Tokyo2019/laobomb.md...
CVE-2021-27246_Pwn2Own2020
Pwn2Own 2020 Tokyo Edition - TPlink exploit Here is the files used to exploit the TPlink Archer router during the Pwn2Own 2020 Tokyo. The vulnerability has CVE-2021-27246 number. You can check blogpost on the synacktiv website for the details...
TP-Link-ArcherC5-RCE
TP-Link Archer C5 Authenticated RCE Through Malicious Configuration File Upload CVE-2018-19537 Description An authenticated remote code execution RCE vulnerability exists in all published firmware versions for the TP-Link Archer C5 router. By uploading a maliciously crafted configuration file, an...
tplink-CVE-2017-11519
tplink-CVE-2017-11519 POC for TP-Link Archer C9 - Admin Password Reset and RCE CVE-2017-11519 See the writeup at https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html...
EUVD-2026-70818
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
EUVD-2026-70819
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
CVE-2026-18330
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
CVE-2026-18167
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
CVE-2026-18167
A stack-based buffer overflow in the EasyMesh module of the TP-Link Archer AX55 v4 allows a LAN attacker, when Mesh mode is enabled, to submit crafted input that crashes the easymesh daemon and may potentially achieve remote code execution . The vulnerability requires no prior authentication but ...
CVE-2026-18167 Stack-based buffer overflow in TP-Link Archer AX55 v4
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
CVE-2026-18330 Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
CVE-2026-18330
A hard-coded shared RSA-1024 private key vulnerability exists in the web module of the TP-Link Archer AX55 v4 . A LAN attacker who captures an HTTP login session can use the known shared private key to decrypt the administrator password , and a weakened AES session key further reduces the effort ...
PT-2026-85267
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
PT-2026-85266
Name of the Vulnerable Software and Affected Versions TP-Link Archer AX55 v4 versions prior to 1.2.1 Build 20260527 Description A stack-based buffer overflow exists in the EasyMesh module. When Mesh mode is enabled, a LAN attacker can submit crafted input to the EasyMesh daemon, which may cause t...
CVE-2026-80712 spi: spi-qpic-snand: write the feature value before executing SET_FEATURE
In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: write the feature value before executing SETFEATURE qcomspisendcmdaddr programs NANDFLASHCMD/NANDEXECCMD and submits the descriptors, which makes the controller execute the command immediately. For...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...
CVE-2026-78541
A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1 . An authenticated adjacent attacker with administrative access can store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report...