Sign-up

ID

VAR-202209-1973


CVE

CVE-2022-40486


TITLE

TP-LINK AX10 code injection vulnerability

Trust: 1.2

sources: CNVD: CNVD-2022-68267 // CNNVD: CNNVD-202209-2845

DESCRIPTION

TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file. TP-LINK Technologies of Archer AX10 V1 A code injection vulnerability exists in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. TP-LINK AX10 is a router from China Pulian (TP-LINK) company. An attacker could exploit this vulnerability to generate an illegal code segment that modifies the expected execution control flow of a network system or component

Trust: 2.16

sources: NVD: CVE-2022-40486 // JVNDB: JVNDB-2022-018075 // CNVD: CNVD-2022-68267

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-68267

AFFECTED PRODUCTS

vendor:tp linkmodel:archer ax10 v1scope:eqversion:1.3.1

Trust: 1.0

vendor:tp linkmodel:archer ax10 v1scope: - version: -

Trust: 0.8

vendor:tp linkmodel:archer ax10 v1scope:eqversion: -

Trust: 0.8

vendor:tp linkmodel:archer ax10 v1scope:eqversion:archer ax10 v1 firmware 1.3.1

Trust: 0.8

vendor:tp linkmodel:archer ax10scope:eqversion:v11.3.1

Trust: 0.6

sources: CNVD: CNVD-2022-68267 // JVNDB: JVNDB-2022-018075 // NVD: CVE-2022-40486

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-40486
value: HIGH

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2022-40486
value: HIGH

Trust: 1.0

NVD: CVE-2022-40486
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-68267
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202209-2845
value: HIGH

Trust: 0.6

CNVD: CNVD-2022-68267
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-40486
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 2.0

NVD: CVE-2022-40486
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-68267 // JVNDB: JVNDB-2022-018075 // CNNVD: CNNVD-202209-2845 // NVD: CVE-2022-40486 // NVD: CVE-2022-40486

PROBLEMTYPE DATA

problemtype:CWE-94

Trust: 1.0

problemtype:Code injection (CWE-94) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-018075 // NVD: CVE-2022-40486

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202209-2845

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-202209-2845

PATCH

title:Patch for TP-LINK AX10 code injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/355521

Trust: 0.6

sources: CNVD: CNVD-2022-68267

EXTERNAL IDS

db:NVDid:CVE-2022-40486

Trust: 3.8

db:JVNDBid:JVNDB-2022-018075

Trust: 0.8

db:CNVDid:CNVD-2022-68267

Trust: 0.6

db:CNNVDid:CNNVD-202209-2845

Trust: 0.6

sources: CNVD: CNVD-2022-68267 // JVNDB: JVNDB-2022-018075 // CNNVD: CNNVD-202209-2845 // NVD: CVE-2022-40486

REFERENCES

url:https://github.com/gscamelo/tp-link-archer-ax10-v1/blob/main/readme.md

Trust: 2.4

url:https://www.tp-link.com/br/home-networking/wifi-router/archer-ax10/

Trust: 2.4

url:https://www.tp-link.com/br/support/download/archer-ax10/v1/

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-40486

Trust: 1.4

url:https://cxsecurity.com/cveshow/cve-2022-40486/

Trust: 0.6

sources: CNVD: CNVD-2022-68267 // JVNDB: JVNDB-2022-018075 // CNNVD: CNNVD-202209-2845 // NVD: CVE-2022-40486

SOURCES

db:CNVDid:CNVD-2022-68267
db:JVNDBid:JVNDB-2022-018075
db:CNNVDid:CNNVD-202209-2845
db:NVDid:CVE-2022-40486

LAST UPDATE DATE

2025-05-22T22:50:47.041000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-68267date:2022-10-12T00:00:00
db:JVNDBid:JVNDB-2022-018075date:2023-10-18T08:10:00
db:CNNVDid:CNNVD-202209-2845date:2022-10-08T00:00:00
db:NVDid:CVE-2022-40486date:2025-05-21T15:16:00.373

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-68267date:2022-10-12T00:00:00
db:JVNDBid:JVNDB-2022-018075date:2023-10-18T00:00:00
db:CNNVDid:CNNVD-202209-2845date:2022-09-28T00:00:00
db:NVDid:CVE-2022-40486date:2022-09-28T13:15:10.410