CVE-2018-11482: TP-Link Ipc Tl-IPC223(P)-6 Firmware

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.

Affected products

• TP-Link Ipc Tl-IPC223(P)-6 Firmware: before 1.0.21 (fixed in 1.0.21)
• TP-Link Tl-IPC323K-D Firmware: before 1.0.21 (fixed in 1.0.21)
• TP-Link Tl-IPC325(KP) Firmware: before 1.0.21 (fixed in 1.0.21)
• TP-Link Tl-IPC40A-4 Firmware: before 1.0.21 (fixed in 1.0.21)

Published 2018-05-30. Last modified 2026-06-17.