CVE-2024-2188

MEDIUM

Cross-Site Scripting vulnerability in TP-Link Archer AX50

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-2188 has a selected CVSS score of 6.1 (medium); EIP currently links 1 curated repository PoC.

Description

Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability could allow an unauthenticated attacker to create a port mapping rule via a SOAP request and store a malicious JavaScript payload within that rule, which could result in an execution of the JavaScript payload when the rule is loaded.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 2, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Archer AX50

Browse TP-Link / Archer AX50

Default status: unaffected

CVE List1.0.11 build 2022052affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2024-2188Curated repository PoCby hacefresko11Exploit3 files

Python · 28.3 MiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2024-2188, a stored XSS vulnerability in TP-Link Archer AX50 firmware, by sending SOAP requests to the UPnP service to inject a JavaScript payload into a port mapping description.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a README and a Python script (poc.py) that demonstrates a stored XSS vulnerability (CVE-2024-2188) by sending SOAP requests to a TP-Link Archer AX50 router. The script deletes a previous port mapping and adds a new one containing a hardcoded XSS payload. No backdoor, deceptive payload, or concealed operator-directed harm is observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareTP-Link Archer AX50 firmware
Attack typesStored XSS
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted SOAP requests to inject a malicious JavaScript payload into the target device, which constitutes exploitation of the stored XSS vulnerability rather than mere detection or scanning.

poc.py:31-52README.md:4-5

Requirements

  • Target device must be a TP-Link Archer AX50 running firmware version 1.0.11 build 2022052 with the UPnP service exposed on port 1900.README.md:3poc.py:11
  • Attacker must provide the victim router IP and attacker IP as command-line arguments.poc.py:3-5

Observed behavior

  • Sends a SOAP DeletePortMapping request to remove any existing port mapping on external port 1337.poc.py:10-27
  • Sends a SOAP AddPortMapping request with a script tag payload in the NewPortMappingDescription field to create a new port mapping.poc.py:30-52
  • The injected JavaScript payload executes when an authenticated user views the UPnP tab in the router's admin interface.README.md:4-6
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Xss Payload
Payload withheldThe PoC injects this payload into the NewPortMappingDescription field of a SOAP AddPortMapping request to demonstrate the stored XSS vulnerability.poc.py:31poc.py:38
Target Url
Payload withheldThe script sends SOAP requests to this URL on the victim router to manipulate UPnP port mappings.poc.py:11
Review boundaries

What the analysis did not establish

  • One binary firmware file (vulnerable_fw/ax50v1_intel-up-ver1-0-11-P1[20220526-rel63519]_sign_2022-05-27_08.55.42.bin) is present but not analyzed; its contents are opaque.
  • The analysis is based solely on the provided text files (README.md and poc.py); the binary file and any other potential artifacts are not inspected.
  • One binary file (vulnerable_fw/ax50v1_intel-up-ver1-0-11-P1[20220526-rel63519]_sign_2022-05-27_08.55.42.bin) was flagged as binary and not analyzed; it is the target firmware, not executable PoC code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2