CVE-2018-11482
CRITICALTP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, TL-IPC40A-4 < 1.0.21 - Hard-coded Credentials
Title source: llmDescription
/usr/lib/lua/luci/websys.lua on TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices has a hardcoded zMiVw8Kw0oxKXL0 password.
References (2)
Core 2
Core References
Third Party Advisory
https://www.us-cert.gov/ncas/bulletins/SB18-155
Broken Link x_refsource_misc
https://github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-login-Escalation-of-Privileges
Scores
CVSS v3
9.8
EPSS
0.0046
EPSS Percentile
64.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-798
Status
published
Products (4)
tp-link/ipc_tl-ipc223\(p\)-6_firmware
< 1.0.21
tp-link/tl-ipc323k-d_firmware
< 1.0.21
tp-link/tl-ipc325\(kp\)_firmware
< 1.0.21
tp-link/tl-ipc40a-4_firmware
< 1.0.21
Published
May 30, 2018
Tracked Since
Feb 18, 2026