Description
An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016DE(UN) V7_1.0.1 Build 20240628.
References (2)
Core 2
Core References
Various Sources third-party-advisory
https://takeonme.org/cves/CVE-2024-4224.html
Various Sources patch
https://www.tp-link.com/en/support/download/tl-sg1016de/v7/#Firmware
Scores
CVSS v3
5.4
EPSS
0.0020
EPSS Percentile
41.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (1)
TP-Link/TL-SG1016DE
< V7.6_1.0.0 Build 20230616
Published
Jul 15, 2024
Tracked Since
Feb 18, 2026