CVE-2018-11482 /usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
CriticalCVSS 9.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link ipc tl-ipc223p-6 firmware | < 1.0.21 | 1.0.21 |
| tp-link tl-ipc323k-d firmware | < 1.0.21 | 1.0.21 |
| tp-link tl-ipc325kp firmware | < 1.0.21 | 1.0.21 |
| tp-link tl-ipc40a-4 firmware | < 1.0.21 | 1.0.21 |
References
- github.com broken-link
- www.us-cert.gov third-party-advisory