CVE-2024-2188

GitHubCurated repository PoCExploitPythonhacefresko/CVEs

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2024-2188, a stored XSS vulnerability in TP-Link Archer AX50 firmware, by sending SOAP requests to the UPnP service to inject a JavaScript payload into a port mapping description.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script (poc.py) that demonstrates a stored XSS vulnerability (CVE-2024-2188) by sending SOAP requests to a TP-Link Archer AX50 router. The script deletes a previous port mapping and adds a new one containing a hardcoded XSS payload. No backdoor, deceptive payload, or concealed operator-directed harm is observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareTP-Link Archer AX50 firmware
Attack typesStored XSS
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted SOAP requests to inject a malicious JavaScript payload into the target device, which constitutes exploitation of the stored XSS vulnerability rather than mere detection or scanning.

poc.py:31-52README.md:4-5

Requirements

  • Target device must be a TP-Link Archer AX50 running firmware version 1.0.11 build 2022052 with the UPnP service exposed on port 1900.README.md:3poc.py:11
  • Attacker must provide the victim router IP and attacker IP as command-line arguments.poc.py:3-5

Observed behavior

  • Sends a SOAP DeletePortMapping request to remove any existing port mapping on external port 1337.poc.py:10-27
  • Sends a SOAP AddPortMapping request with a script tag payload in the NewPortMappingDescription field to create a new port mapping.poc.py:30-52
  • The injected JavaScript payload executes when an authenticated user views the UPnP tab in the router's admin interface.README.md:4-6
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
<script>alert('XSS')</script>The PoC injects this payload into the NewPortMappingDescription field of a SOAP AddPortMapping request to demonstrate the stored XSS vulnerability.poc.py:31poc.py:38
Target Url
http://<victim>:1900/ctl/IPConnThe script sends SOAP requests to this URL on the victim router to manipulate UPnP port mappings.poc.py:11
Review boundaries

What the analysis did not establish

  • One binary firmware file (vulnerable_fw/ax50v1_intel-up-ver1-0-11-P1[20220526-rel63519]_sign_2022-05-27_08.55.42.bin) is present but not analyzed; its contents are opaque.
  • The analysis is based solely on the provided text files (README.md and poc.py); the binary file and any other potential artifacts are not inspected.
  • One binary file (vulnerable_fw/ax50v1_intel-up-ver1-0-11-P1[20220526-rel63519]_sign_2022-05-27_08.55.42.bin) was flagged as binary and not analyzed; it is the target firmware, not executable PoC code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1