CVE-2022-4498: tp-link archer_c5_firmware Out-of-bounds Write

Vulnerability summary

CVE-2022-4498 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in tp-link archer_c5_firmware. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78% of scored vulnerabilities.

Timeline

1. 11-01-2023
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashing the httpd process) or an arbitrary code execution.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.