Sign-up

ID

VAR-202210-1596


CVE

CVE-2022-41540


TITLE

TP-LINK AX10 Trust Management Issue Vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202210-1197

DESCRIPTION

The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle attack can then obtain the sequence key via a brute-force attack, and access sensitive information.

Trust: 1.0

sources: NVD: CVE-2022-41540

AFFECTED PRODUCTS

vendor:tp linkmodel:ax10scope:eqversion:v1_211117

Trust: 1.0

sources: NVD: CVE-2022-41540

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-41540
value: MEDIUM

Trust: 1.0

134c704f-9b21-4f2e-91b3-4a467353bcc0: CVE-2022-41540
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-202210-1197
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2022-41540
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.1

Trust: 2.0

sources: CNNVD: CNNVD-202210-1197 // NVD: CVE-2022-41540 // NVD: CVE-2022-41540

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.0

sources: NVD: CVE-2022-41540

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202210-1197

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-202210-1197

PATCH

title:TP-LINK AX10 Repair measures for trust management problem vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=211494

Trust: 0.6

sources: CNNVD: CNNVD-202210-1197

EXTERNAL IDS

db:NVDid:CVE-2022-41540

Trust: 1.6

db:CNNVDid:CNNVD-202210-1197

Trust: 0.6

sources: CNNVD: CNNVD-202210-1197 // NVD: CVE-2022-41540

REFERENCES

url:https://www.tp-link.com/us/support/download/archer-ax10/v1/#firmware

Trust: 1.6

url:https://github.com/efchatz/easy-exploits/tree/main/web/tp-link/offline-decryption

Trust: 1.6

url:https://cxsecurity.com/cveshow/cve-2022-41540/

Trust: 0.6

sources: CNNVD: CNNVD-202210-1197 // NVD: CVE-2022-41540

SOURCES

db:CNNVDid:CNNVD-202210-1197
db:NVDid:CVE-2022-41540

LAST UPDATE DATE

2025-05-17T03:50:50.449000+00:00


SOURCES UPDATE DATE

db:CNNVDid:CNNVD-202210-1197date:2022-10-21T00:00:00
db:NVDid:CVE-2022-41540date:2025-05-15T15:16:06.077

SOURCES RELEASE DATE

db:CNNVDid:CNNVD-202210-1197date:2022-10-18T00:00:00
db:NVDid:CVE-2022-41540date:2022-10-18T15:15:10.197