CVE-2022-4498

In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashing the httpd process) or an arbitrary code execution.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cret@cert.org

Published

2023-01-11

Last modified

2025-11-04

Weaknesses

CWE-787

Affected products

• Archer C5 (Tp-link)
• Archer C5 Firmware (Tp-link)
• Tl-wr710n Firmware (Tp-link)
• Wr710n (Tp-link)

References

• https://kb.cert.org/vuls/id/572615
• https://www.kb.cert.org/vuls/id/572615