CVE-2022-30075

HIGH

TP-Link Router AX50 Authenticated Remote Code Execution Vulnerability

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-30075 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit and 4 repository PoCs.

Description

In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 26, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Repository PoCs
4

Affected products and versions

1
ProductSourceVersion range

archer_ax50_firmware

Browse TP-Link / archer_ax50_firmware
VulnCheckVersion data not supplied

Proofs of concept

5

Catalogued exploits

ExploitDBTP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)ExploitDB exploitby Tomas MelicherNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubRhestCorp/TP-L-NK-SIZMA-EXPLO-TRepository PoCby RhestCorp1Exploit3 files

15.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2022-30075 targeting TP-Link Archer AX50 routers. It authenticates, downloads the encrypted configuration backup, decrypts it using a hardcoded AES key, injects a command into the DDNS configuration, re-encrypts the backup, and restores it to achieve authenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2022-30075. The script performs authenticated remote code execution on TP-Link routers by downloading, decrypting, modifying, re-encrypting, and restoring a configuration backup. The injected command defaults to starting a telnet daemon. No concealed, deceptive, or operator-directed harmful behavior beyond the stated exploit functionality was observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesPython
Target softwareTP-Link Archer AX50 Router Firmware
Attack typesAuthenticated Remote Code ExecutionCommand Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Python script that performs all steps required to exploit CVE-2022-30075: authentication, configuration download, decryption, command injection, re-encryption, and restoration. It is designed to execute arbitrary commands on the target, not merely detect the vulnerability.

tplink.py:1-287README.md:1-2

Requirements

  • Valid administrator password for the target TP-Link router.tplink.py:16-18
  • Network access to the router's web interface.tplink.py:65

Observed behavior

  • Authenticates to the router using the provided password.tplink.py:99-106
  • Downloads the encrypted configuration backup file from the router.tplink.py:254-255
  • Decrypts the configuration backup using a hardcoded AES key and IV.tplink.py:116-117tplink.py:167-202
  • Injects a user-supplied command into the DDNS service configuration within the decrypted XML.tplink.py:205-238
  • Re-encrypts the modified configuration and uploads it to the router to trigger a restore and reboot.tplink.py:275-280
  • Instructs the user to connect via telnet to the router after reboot to obtain a root shell.tplink.py:287
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Default Command
Payload withheldThe default command injected into the router configuration starts a telnet daemon, which is consistent with the stated purpose of gaining root shell access.tplink.py:247
Hardcoded Key
Payload withheldA hardcoded AES key is used to decrypt and re-encrypt the router configuration backup. This is necessary for the exploit to function and is not indicative of a backdoor.tplink.py:116
Author Attribution
Payload withheldThe script prints an author/team name at startup. This is a common practice in proof-of-concept exploits and does not constitute malicious behavior.tplink.py:12
Review boundaries

What the analysis did not establish

  • One file (total 3) was omitted from the packet due to content selection rules, but the two included text files (README.md and tplink.py) provide complete coverage of the exploit logic.
  • One file in the repository (metadata only) was not included in the text analysis; its content is unknown.
  • The review is limited to static analysis of the provided source code; no dynamic or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubaaronsvk/CVE-2022-30075Repository PoCby aaronsvk235Not analyzed2 files

14.1 KiB

GitHub
PoC details
GitHubSAJIDAMINE/CVE-2022-30075Repository PoCby SAJIDAMINE3Not analyzed1 file

11.9 KiB

GitHub
PoC details
GitHubM4fiaB0y/CVE-2022-30075Repository PoCby M4fiaB0y1Not analyzed2 files

12.2 KiB

GitHub
PoC details

References

6