CVE-2023-49913 in AC1350
Summary
by MITRE • 04/09/2024
A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `action` parameter at offset `0x422448` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2025
The CVE-2023-49913 vulnerability represents a critical stack-based buffer overflow affecting TP-Link EAP225 V3 access points running firmware version 5.1.0 build 20220926. This flaw manifests within the web interface's Radio Scheduling functionality, creating a pathway for remote code execution that significantly compromises network security. The vulnerability's exploitation requires an authenticated HTTP request, indicating that while the attack vector is accessible to authenticated users, it still presents a substantial risk as it can be leveraged by attackers who have obtained valid credentials or through credential compromise techniques. The technical implementation of this vulnerability involves a specific memory corruption pattern where the `action` parameter triggers buffer overflow at offset 0x422448 within the httpd binary, which is a core component of the device's web server functionality. This particular offset suggests a well-defined memory layout where the buffer overflow occurs in the web server process, potentially allowing attackers to overwrite critical memory structures including return addresses and function pointers. The vulnerability's classification aligns with CWE-121 Stack-based Buffer Overflow, which occurs when a program writes data beyond the boundaries of a fixed-length stack buffer, leading to memory corruption and potential code execution. The attack surface is particularly concerning as it involves the HTTP daemon that serves web interface requests, making it a prime target for exploitation. The fact that this vulnerability was also present in the EAP115 device with firmware version 5.0.4 build 20220216 indicates a persistent flaw in the firmware development lifecycle, suggesting inadequate input validation and memory management practices during the software development phase. The remote code execution capability stems from the ability to manipulate the program flow through buffer overflow, potentially allowing attackers to execute arbitrary code with the privileges of the web server process. This creates a significant risk for network infrastructure as the compromised access point could serve as a foothold for lateral movement within the network, potentially enabling attackers to access other connected devices or escalate privileges to administrative control of the entire wireless network infrastructure. The operational impact extends beyond simple code execution, as the vulnerability could enable persistent backdoors, data exfiltration, or disruption of network services, making it a serious concern for enterprise and organizational security. Organizations should implement immediate mitigations including firmware updates from TP-Link, network segmentation to isolate affected devices, and monitoring for suspicious HTTP requests targeting the web interface. The ATT&CK framework categorizes this vulnerability under T1210 Exploitation of Remote Services, where attackers leverage web server vulnerabilities to gain unauthorized access and execute malicious code. Security professionals should also consider implementing network-based intrusion detection systems to monitor for exploitation attempts and conduct thorough vulnerability assessments to identify other potentially affected devices in the network infrastructure.