GCVE-1988-2026-0481

Vulnerability from gna-1988 – Published: 2026-11-02 07:30 – Updated: 2026-11-02 07:30
VLAI
Title
SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series
Summary
SEC Consult Vulnerability Lab Security Advisory < 20261008-0 > ======================================================================= title: Multiple critical vulnerabilities           product: Multiple TP-Link device series Mesh: HB Series, HX Series, HC Series; Router: EB Series EC Series, EX Series; PON: XC Series, XX Series; xDSL modem: VX Series vulnerable version: Multiple affected versions     fixed version: See solution below          CVE number: CVE-2025-30237, CVE-2025-30238, CVE-2025-30239 CVE-2025-30240, CVE-2025-30241              impact: critical homepage:https://www.tp-link.com             found: 2024-12-02 by: Gerhard Hechenberger (Office Vienna) Stefan Schweighofer (Office Vienna) Constantin Schieber-Knoebl (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Headquartered in the United States, TP-Link is a global provider of reliable networking devices and smart home products, consistently ranked as the world’s top provider of Wi-Fi devices. The company is committed to delivering innovative products that enhance people’s lives through faster, more reliable connectivity. With a commitment to excellence, TP-Link serves customers in over 170 countries and continues to grow its global footprint." Source:https://www.tp-link.com/us/about/about-us/ Business recommendation: ------------------------ The vendor provides patches for multiple affected devices which should be installed immediately. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Authentication Bypass (CVE-2025-30237) The currently implemented authentication flow of the web server of the affected device makes it possible to craft special requests, which allow an attacker to directly execute certain actions on the device, without any valid user credentials. This vulnerability makes it possible to execute any action that is shown in the "Broken Access Control" vulnerability description without any authentication. Exploiting this, an attacker can effectively take over the device, given that access to the web server is possible. 2) Broken Access Control (CVE-2025-30238) The affected device features several user profiles with different user levels. Due to insufficient checks on the device itself, an authenticated attacker can execute actions as low privileged user that are meant to be only executed as a high privileged user. An authenticated attacker can therefore create a high privileged user profile and fully take over the device by enabling SSH and logging in with the new account. 3) Sensitive Data Stored Insecurely (CVE-2025-30239) The affected device stores sensitive data in an ineffectively protected format in multiple locations. The used symmetric cryptography makes use of hardcoded keys which are only tied to the device model. After reversing the firmware and extracting the hardcoded keys, an attacker can effectively decrypt the following files and read plaintext credentials, including the used passwords. Depending on the device configuration, CWMP provider credentials can also be extracted. - Default Configuration (default user and Wi-Fi credentials) - Active Configuration (all user account credentials, Wi-Fi credentials and CWMP credentials) - Configuration Backup (all user account credentials, Wi-Fi credentials and CWMP credentials) 4) Unsafe Symbolic Link Processing (CVE-2025-30240) The USB port on the affected device enables an attacker to place a symbolic link on USB storage devices and gain read access to the complete file system of the device. 5) Authenticated OS Command Injection (CVE-2025-30241) Multiple input fields of the web interface are not sanitized properly and therefore allow an attacker to inject and execute arbitrary OS commands. The commands are executed with root privileges on the device, allowing to fully take over the device from the web interface. Proof of concept: ----------------- 1) Authentication Bypass (CVE-2025-30237) The authentication bypass is based on the handling of the custom transport layer encryption, which is used in HTTP and HTTPS connections. The transport layer encryption is already well known publicly, for example it is described in the following blog post: <https://hex.fish/2021/05/10/tp-link-gdpr/> During authentication the following steps are executed: 1. The client requests RSA parameters and the sequence number via the /cgi/getParm endpoint. 2. The client provides an AES key and IV to be used for upcoming encrypted requests. The web server of the device communicates with the client via HTTP POST "sign" and "data" parameters. The "sign" parameter is based on the following data after successful authentication: [ redacted ] The "data" parameter contains BASE64 encoded JSON data which is encrypted that describes the action that should be executed on the device. For a login request the "sign" parameter looks slightly different, since the client and device need to exchange encryption parameters first. For this purpose the client provides an AES key and IV to the device via the "sign" parameter during a login request: [ redacted ] As an example the following "sign" parameter is valid, given that the sequence number is valid to the device. [ redacted ] An attacker can use the initial "sign" parameter format, with key and IV, to bypass the authentication, by replacing the "data" parameter with any action that should be executed on the device. For example, an attacker is able to create a "Superadmin" user on the device and enable SSH to gain full access to the device. Therefore, all examples described in issue 2 "Broken Access Control" of this advisory are now possible without any authentication. 2) Broken Access Control (CVE-2025-30238) In order to exploit the broken access control vulnerability an attacker must be able to create or modify valid requests which follow the rules of the custom transport layer encryption that is used by the affected device. For this, an attacker only needs valid credentials for a low privileged user, who is able to log in on the web portal of the device. With a valid session an attacker can then send requests to the device, which are only meant to be performed by high privileged users on the device. This includes reading user credentials, enabling SSH or Telnet and reading CWMP credentials. The following examples show the unencrypted JSON data that can be sent to the device in the "data" parameter of a normal action POST request. Example 1: Creating a Superadmin user { "data": { "X_TP_Grade": "Superadmin", "username": "$USERNAME", "password": "$PASSWORD", [redacted] }, [redacted]   "isuseractive": true } Example 2: Reading User Credentials { "data": { "stack": "0,0,0,0,0,0", "pstack": "0,0,0,0,0,0" }, [redacted]   "isuseractive": true } Example 3: Enabling SSH { "data": { "localPort": "22", "sessionLifeTime": "0", "localEnabled": "1", [redacted]   }, [redacted] } 3) Sensitive Data Stored Insecurely (CVE-2025-30239) The following examples show how the different encrypted configurations and backups can be decrypted to read plaintext credentials, including the used passwords. Example 1: Decryption of Default Configuration The file "default_configuration.xml" contains the default user and Wi-Fi credentials in plaintext. This file is also contained in the firmware update file in the following path: /etc/default_configuration.xml The configuration is encrypted using DES-ECB and a static key. The parameters for decryption are already well-known online. With the following command the default configuration can be decrypted: [ PoC removed ] The resulting file will contain the default plaintext credentials: <X_TP_UserCfg> <RootName val=$PLAINTEXT_USERNAME /> <RootPwd val=$PLAINTEXT_PASSWORD /> [...] </X_TP_UserCfg> Example 2: Decryption of Active Configuration The active configuration is stored at an emulated flash memory address. This file can be found in the following path: /var/run/misc/misc_rw/0x00200000 The file itself is compressed using BriefLZ and encrypted using AES-128-CBC and a static key. The AES key and IV can be recovered by analyzing the libcmm.so and libgdpr.so binaries. The decompression step can be analyzed via the libcutil.so binary. To recover the plaintext, the header of the file (first 16 bytes) need to be discarded. After that the file can be decrypted with the following command and afterwards decompressed. [ PoC removed ] The BriefLZ tool (https://github.com/jibsen/brieflz) can be used for decompression after a short patch that enables RAW byte support at a specific offset (4 bytes). For this purpose the the BriefLZ function blz_depack() can be used. The resulting file for example contains all configured user plaintext credentials: <Users> <UserNumberOfEntries val=5 /> <User instance=1 > <RemoteAccessCapable val=1 /> <Username val=$PLAINTEXT_USERNAME /> <Password val=$PLAINTEXT_PASSWORD /> [...] </User> Example 3: Decryption of Configuration Backup A backup can be created in the web portal of the device. The created backup is encrypted even if no password is set by the user. The resulting file is called "conf.bin". This file is compressed and encrypted using DES-ECB with a static key that is derived from two sources. The backup encryption is already known online (https://github.com/sta-c0000/tpconf_bin_xml/blob/master/tpconf_bin_xml.py) and can be used with the correct key. The static key can be recovered if the following two parts are known: 1. Base key (static bytes embedded in the libcmm.so binary file) 2. Model key (product ID, present in a data model file) The final key for the backup is created if both parts are XORed: Base key (hex) 74************cf Model key (hex) 35************31 Final key (hex) 41************fe Using the final key and the tool mentioned the plaintext can be recovered: $ python tpconf_bin_xml/tpconf_bin_xml.py -o conf.bin conf.xml The resulting XML file will contain for example the plaintext Wi-Fi credentials. <Security> <ModeEnabled val=WPA2-WPA3-Personal /> <X_TP_PSKType val=KeyPassphrase /> <PreSharedKey val=$PRESHAREDKEY /> <KeyPassphrase val=$PLAINTEXT_PASSWORD /> <X_TP_WPAWPA2EncryptionMode val=AES /> </Security> 4) Unsafe Symbolic Link Processing (CVE-2025-30240) Physical access to the device allows an attacker to use the USB port on the device. For the attacker a USB storage device needs to be NTFS formatted and a symbolic link created. The symbolic link can be created via the following command: $ ln -s / rootfs If the USB storage device is detected by the device, the symbolic link will be accessible via the following URL: http://$IP:8052/sda1/rootfs/ Under this URL the whole file system can be read, including the active configuration of the device. The active configuration is accessible via the following path: /var/run/misc/misc_rw/0x00200000 The configuration itself is encrypted, but can be read via the proof of concept described in issue 3 "Sensitive Data Stored Insecurely". 5) Authenticated OS Command Injection (CVE-2025-30241) As a prerequisite, authenticated access to the web interface is needed. The first vulnerable input is the content user password. It is reachable by navigating to: Advanced -> USB Devices -> Sharing Access -> Sharing Account -> Passwor
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
unknown Multiple TP-Link device series Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0481 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Multiple TP-Link device series",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20261008-0 \u003e\n=======================================================================\n              title: Multiple critical vulnerabilities\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 product: Multiple TP-Link device series\n                     Mesh: HB Series, HX Series, HC Series; Router: EB Series\n                     EC Series, EX Series; PON: XC Series, XX Series;\n                     xDSL modem: VX Series\n vulnerable version: Multiple affected versions\n  \u00a0 \u00a0 fixed version: See solution below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-30237, CVE-2025-30238, CVE-2025-30239\n                     CVE-2025-30240, CVE-2025-30241\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.tp-link.com\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2024-12-02\n                 by: Gerhard Hechenberger (Office Vienna)\n                     Stefan Schweighofer (Office Vienna)\n                     Constantin Schieber-Knoebl (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Headquartered in the United States, TP-Link is a global provider of reliable\nnetworking devices and smart home products, consistently ranked as the\nworld\u2019s top provider of Wi-Fi devices. The company is committed to delivering\ninnovative products that enhance people\u2019s lives through faster, more reliable\nconnectivity. With a commitment to excellence, TP-Link serves customers in\nover 170 countries and continues to grow its global footprint.\"\n\nSource:https://www.tp-link.com/us/about/about-us/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patches for multiple affected devices which should be\ninstalled immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Authentication Bypass (CVE-2025-30237)\nThe currently implemented authentication flow of the web server of the\naffected device makes it possible to craft special requests, which allow\nan attacker to directly execute certain actions on the device, without any\nvalid user credentials. This vulnerability makes it possible to execute\nany action that is shown in the \"Broken Access Control\" vulnerability\ndescription without any authentication. Exploiting this, an attacker\ncan effectively take over the device, given that access to the web server\nis possible.\n\n2) Broken Access Control (CVE-2025-30238)\nThe affected device features several user profiles with different\nuser levels. Due to insufficient checks on the device itself, an\nauthenticated attacker can execute actions as low privileged user that\nare meant to be only executed as a high privileged user.\nAn authenticated attacker can therefore create a high privileged user\nprofile and fully take over the device by enabling SSH and logging in\nwith the new account.\n\n3) Sensitive Data Stored Insecurely (CVE-2025-30239)\nThe affected device stores sensitive data in an ineffectively\nprotected format in multiple locations. The used symmetric cryptography\nmakes use of hardcoded keys which are only tied to the device model.\nAfter reversing the firmware and extracting the hardcoded keys,\nan attacker can effectively decrypt the following files and read\nplaintext credentials, including the used passwords. Depending on the\ndevice configuration, CWMP provider credentials can also be extracted.\n- Default Configuration (default user and Wi-Fi credentials)\n- Active Configuration (all user account credentials, Wi-Fi credentials and\n  CWMP credentials)\n- Configuration Backup (all user account credentials, Wi-Fi credentials and\n  CWMP credentials)\n\n4) Unsafe Symbolic Link Processing (CVE-2025-30240)\nThe USB port on the affected device enables an attacker to\nplace a symbolic link on USB storage devices and gain read access\nto the complete file system of the device.\n\n5) Authenticated OS Command Injection (CVE-2025-30241)\nMultiple input fields of the web interface are not sanitized properly and\ntherefore allow an attacker to inject and execute arbitrary OS commands. The\ncommands are executed with root privileges on the device, allowing to fully\ntake over the device from the web interface.\n\n\nProof of concept:\n-----------------\n1) Authentication Bypass (CVE-2025-30237)\nThe authentication bypass is based on the handling of the custom\ntransport layer encryption, which is used in HTTP and HTTPS connections.\nThe transport layer encryption is already well known publicly, for example\nit is described in the following blog post:\n\u003chttps://hex.fish/2021/05/10/tp-link-gdpr/\u003e\n\nDuring authentication the following steps are executed:\n  1. The client requests RSA parameters and the sequence number\n     via the /cgi/getParm endpoint.\n  2. The client provides an AES key and IV to be used for upcoming\n     encrypted requests.\n\nThe web server of the device communicates with the client via\nHTTP POST \"sign\" and \"data\" parameters. The \"sign\" parameter\nis based on the following data after successful authentication:\n\n[ redacted ]\n\nThe \"data\" parameter contains BASE64 encoded JSON data which is\nencrypted that describes the action that should be executed on\nthe device.\n\nFor a login request the \"sign\" parameter looks slightly different,\nsince the client and device need to exchange encryption parameters first.\nFor this purpose the client provides an AES key and IV to the device\nvia the \"sign\" parameter during a login request:\n\n[ redacted ]\n\nAs an example the following \"sign\" parameter is valid, given\nthat the sequence number is valid to the device.\n\n[ redacted ]\n\nAn attacker can use the initial \"sign\" parameter format, with key and IV,\nto bypass the authentication, by replacing the \"data\" parameter\nwith any action that should be executed on the device.\n\nFor example, an attacker is able to create a \"Superadmin\" user\non the device and enable SSH to gain full access to the device.\nTherefore, all examples described in issue 2 \"Broken Access Control\"\nof this advisory are now possible without any authentication.\n\n2) Broken Access Control (CVE-2025-30238)\nIn order to exploit the broken access control vulnerability an\nattacker must be able to create or modify valid requests which\nfollow the rules of the custom transport layer encryption\nthat is used by the affected device. For this, an attacker\nonly needs valid credentials for a low privileged user, who\nis able to log in on the web portal of the device. With a valid\nsession an attacker can then send requests to the device, which\nare only meant to be performed by high privileged users on the\ndevice. This includes reading user credentials, enabling SSH or\nTelnet and reading CWMP credentials. The following examples\nshow the unencrypted JSON data that can be sent to the device\nin the \"data\" parameter of a normal action POST request.\n\nExample 1: Creating a Superadmin user\n{\n  \"data\": {\n    \"X_TP_Grade\": \"Superadmin\",\n    \"username\": \"$USERNAME\",\n    \"password\": \"$PASSWORD\",\n        [redacted]\n  },\n  [redacted]\n\u00a0 \"isuseractive\": true\n}\n\nExample 2: Reading User Credentials\n{\n  \"data\": {\n    \"stack\": \"0,0,0,0,0,0\",\n    \"pstack\": \"0,0,0,0,0,0\"\n  },\n  [redacted]\n\u00a0 \"isuseractive\": true\n}\n\nExample 3: Enabling SSH\n{\n  \"data\": {\n    \"localPort\": \"22\",\n    \"sessionLifeTime\": \"0\",\n    \"localEnabled\": \"1\",\n    [redacted]\n\u00a0 },\n  [redacted]\n}\n\n3) Sensitive Data Stored Insecurely (CVE-2025-30239)\nThe following examples show how the different encrypted\nconfigurations and backups can be decrypted to read plaintext\ncredentials, including the used passwords.\n\nExample 1: Decryption of Default Configuration\nThe file \"default_configuration.xml\" contains the default user\nand Wi-Fi credentials in plaintext. This file is also contained in\nthe firmware update file in the following path:\n/etc/default_configuration.xml\n\nThe configuration is encrypted using DES-ECB and a static key. The\nparameters for decryption are already well-known online. With the\nfollowing command the default configuration can be decrypted:\n\n[ PoC removed ]\n\nThe resulting file will contain the default plaintext credentials:\n\n\u003cX_TP_UserCfg\u003e\n  \u003cRootName val=$PLAINTEXT_USERNAME /\u003e\n  \u003cRootPwd val=$PLAINTEXT_PASSWORD /\u003e\n  [...]\n\u003c/X_TP_UserCfg\u003e\n\nExample 2: Decryption of Active Configuration\nThe active configuration is stored at an emulated flash memory address.\nThis file can be found in the following path:\n/var/run/misc/misc_rw/0x00200000\n\nThe file itself is compressed using BriefLZ and encrypted using\nAES-128-CBC and a static key. The AES key and IV can be recovered\nby analyzing the libcmm.so and libgdpr.so binaries. The decompression\nstep can be analyzed via the libcutil.so binary. To recover the\nplaintext, the header of the file (first 16 bytes) need to be\ndiscarded. After that the file can be decrypted with the following\ncommand and afterwards decompressed.\n\n[ PoC removed ]\n\nThe BriefLZ tool (https://github.com/jibsen/brieflz) can be used for\ndecompression after a short patch that enables RAW byte support at\na specific offset (4 bytes). For this purpose the the BriefLZ\nfunction blz_depack() can be used.\n\nThe resulting file for example contains all configured user\nplaintext credentials:\n\n\u003cUsers\u003e\n  \u003cUserNumberOfEntries val=5 /\u003e\n  \u003cUser instance=1 \u003e\n    \u003cRemoteAccessCapable val=1 /\u003e\n    \u003cUsername val=$PLAINTEXT_USERNAME /\u003e\n    \u003cPassword val=$PLAINTEXT_PASSWORD /\u003e\n[...]\n\u003c/User\u003e\n\nExample 3: Decryption of Configuration Backup\nA backup can be created in the web portal of the device.\nThe created backup is encrypted even if no password is set\nby the user. The resulting file is called \"conf.bin\". This\nfile is compressed and encrypted using DES-ECB with a static\nkey that is derived from two sources. The backup encryption\nis already known online (https://github.com/sta-c0000/tpconf_bin_xml/blob/master/tpconf_bin_xml.py)\nand can be used with the correct key. The static key can be\nrecovered if the following two parts are known:\n1. Base key (static bytes embedded in the libcmm.so binary file)\n2. Model key (product ID, present in a data model file)\n\nThe final key for the backup is created if both parts are\nXORed:\nBase key  (hex) 74************cf\nModel key (hex) 35************31\nFinal key (hex) 41************fe\n\nUsing the final key and the tool mentioned the plaintext\ncan be recovered:\n$ python tpconf_bin_xml/tpconf_bin_xml.py -o conf.bin conf.xml\n\nThe resulting XML file will contain for example the plaintext\nWi-Fi credentials.\n\n\u003cSecurity\u003e\n  \u003cModeEnabled val=WPA2-WPA3-Personal /\u003e\n  \u003cX_TP_PSKType val=KeyPassphrase /\u003e\n  \u003cPreSharedKey val=$PRESHAREDKEY /\u003e\n    \u003cKeyPassphrase val=$PLAINTEXT_PASSWORD /\u003e\n    \u003cX_TP_WPAWPA2EncryptionMode val=AES /\u003e\n\u003c/Security\u003e\n\n4) Unsafe Symbolic Link Processing (CVE-2025-30240)\nPhysical access to the device allows an attacker to use the\nUSB port on the device. For the attacker a USB storage device\nneeds to be NTFS formatted and a symbolic link created.\nThe symbolic link can be created via the following command:\n\n$ ln -s / rootfs\n\nIf the USB storage device is detected by the device, the symbolic\nlink will be accessible via the following URL:\n\nhttp://$IP:8052/sda1/rootfs/\n\nUnder this URL the whole file system can be read, including\nthe active configuration of the device. The active configuration\nis accessible via the following path:\n\n/var/run/misc/misc_rw/0x00200000\n\nThe configuration itself is encrypted, but can be read via the\nproof of concept described in issue 3 \"Sensitive Data Stored Insecurely\".\n\n5) Authenticated OS Command Injection (CVE-2025-30241)\nAs a prerequisite, authenticated access to the web interface is needed.\nThe first vulnerable input is the content user password. It is reachable by\nnavigating to:\n\nAdvanced -\u003e USB Devices -\u003e Sharing Access -\u003e Sharing Account -\u003e Passwor"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:02Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/11"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/11"
        },
        {
          "url": "http://$IP:8052/sda1/rootfs/"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://github.com/jibsen/brieflz"
        },
        {
          "url": "https://github.com/sta-c0000/tpconf_bin_xml/blob/master/tpconf_bin_xml.py"
        },
        {
          "url": "https://hex.fish/2021/05/10/tp-link-gdpr/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://vulnogram.org/seaview/?CVE-2025-30237"
        },
        {
          "url": "https://vulnogram.org/seaview/?CVE-2025-30238"
        },
        {
          "url": "https://vulnogram.org/seaview/?CVE-2025-30239"
        },
        {
          "url": "https://vulnogram.org/seaview/?CVE-2025-30240"
        },
        {
          "url": "https://vulnogram.org/seaview/?CVE-2025-30241"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.tp-link.com"
        },
        {
          "url": "https://www.tp-link.com/us/about/about-us/"
        },
        {
          "url": "https://www.tp-link.com/us/support/faq/5239/"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/11"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20261008-0 :: Multiple critical vulnerabilities in multiple TP-Link device series",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-30237",
              "type": "related"
            },
            {
              "destId": "CVE-2025-30238",
              "type": "related"
            },
            {
              "destId": "CVE-2025-30239",
              "type": "related"
            },
            {
              "destId": "CVE-2025-30240",
              "type": "related"
            },
            {
              "destId": "CVE-2025-30241",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0481",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/11",
            "automated": true,
            "contentSha256": "f78e8fa190e3778457c94baa6153c3c891c6dc47dda8b613c9ae05dddb3ec842",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/11",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-08T07:07:30Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0481"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:02Z",
    "dateUpdated": "2026-11-02T07:30:02Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0481"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.