CVE-2023-49911 Memory corruption in AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)

High 7.2 Published 9 Apr 2024 Updated 4 Nov 2025

An authenticated attacker can trigger a stack-based buffer overflow in the web interface to achieve remote code execution on Tp-Link access points.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-49911?

CVE-2023-49911 is a high-severity memory corruption vulnerability in Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3), published on 9 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of HTTP requests can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.This vulnerability refers specifically to the overflow that occurs via the `band` parameter at offset `0x422420` of the `httpd` binary shipped with v5.0.4 Build 20220216 of the EAP115.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2023-49911?

It affects 2 products.

Products include Tp-Link Eap115 Firmware, Tp-Link Eap225 Firmware.

How do I fix CVE-2023-49911?

No fix has been published for CVE-2023-49911 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-49911 being exploited?

There is no known exploitation of CVE-2023-49911 in the wild and no public exploit code.

Sources

Also known as GHSA-jrf6-frj2-w4m8.