CVE-2022-30075
Published: 09 June 2022
Summary
CVE-2022-30075 is a high-severity an unspecified weakness vulnerability in Tp-Link Archer Ax50 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2022-30075 is present in TP-Link Router AX50 firmware version 210730 and earlier. It arises from improper validation when a backup file is imported through the web interface, allowing the processing of malicious content that leads to remote code execution.
An attacker with valid credentials and network access to the web interface can upload a crafted backup file to trigger arbitrary code execution. This grants full control over the device, enabling impacts to confidentiality, integrity, and availability as reflected in the CVSS 8.8 rating.
Public exploit code and proof-of-concept materials have been published on Exploit-DB, Packet Storm Security, and a dedicated GitHub repository. The associated EPSS score has remained stable near its peak of 0.8927 with no material rise from a low baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35289
Vulnerability details
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.