TP-Link AX1800 hotplugd Firewall Rule race condition

Summaryinfo

A vulnerability classified as critical has been found in TP-Link AX1800. Affected is an unknown function of the component hotplugd Firewall Rule Handler. The manipulation leads to race condition. This vulnerability is listed as CVE-2023-27359. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in TP-Link AX1800 (version now known). It has been rated as very critical. This issue affects some unknown processing of the component hotplugd Firewall Rule Handler. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

TP-Link AX1800 hotplugd Firewall Rule Race Condition Vulnerability. This vulnerability allows remote attackers to gain access to LAN-side services on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hotplugd daemon. The issue results from firewall rule handling that allows an attacker access to resources that should be available to the LAN interface only. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the root user. . Was ZDI-CAN-19664.

The weakness was presented 04/24/2023. It is possible to read the advisory at zerodayinitiative.com. The identification of this vulnerability is CVE-2023-27359 since 02/28/2023. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/06/2025).

Upgrading eliminates this vulnerability. The upgrade is hosted for download at tp-link.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• TP-Link

Name

• AX1800

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion