CVE-2021-40288 Denial of service in n/a
Remote attackers can disconnect wireless clients from TP-Link AX10v1 routers by sending spoofed authentication frames, causing service disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-40288?
CVE-2021-40288 is a high-severity denial of service vulnerability in n/a, published on 7 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in TP-Link AX10v1 before V1_211014, allows a remote unauthenticated attacker to disconnect an already connected wireless client via sending with a wireless adapter specific spoofed authentication frames
Weakness: CWE-290
Which versions are affected by CVE-2021-40288?
It affects 1 product.
Products include Tp-Link Archer Ax10 Firmware.
How do I fix CVE-2021-40288?
No fix has been published for CVE-2021-40288 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-40288 being exploited?
There is no known exploitation of CVE-2021-40288 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xgq6-2343-xvcm.