TP-Link AX10 Firmware vulnerabilities

2 CVEs affecting TP-Link AX10 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-41541, published 2022-10-18.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-41541, published 2022-10-18. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. TP-Link AX10v1 V1_211117 allows attackers to execute a replay attack by using a previously transmitted encrypted authentication message and valid authentication token. Attackers are able to login to…
• CVE-2022-41540, published 2022-10-18. Medium severity, CVSS 5.9. EPSS: 1.4% chance of exploitation in the next 30 days. The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and…