High severity8.8NVD Advisory· Published May 30, 2018· Updated Jun 17, 2026

CVE-2018-11481

Description

TP-LINK IPC TL-IPC223(P)-6, TL-IPC323K-D, TL-IPC325(KP)-*, and TL-IPC40A-4 devices allow authenticated remote code execution via crafted JSON data because /usr/lib/lua/luci/torchlight/validator.lua does not block various punctuation characters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

TP-Link/Ipc Tl Ipc223\(p\) 6 Firmware
cpe:2.3:o:tp-link:ipc_tl-ipc223\(p\)-6_firmware:*:*:*:*:*:*:*:*
Range: <1.0.21
TP-Link/Tl Ipc323k D Firmware
cpe:2.3:o:tp-link:tl-ipc323k-d_firmware:*:*:*:*:*:*:*:*
Range: <1.0.21
TP-Link/Tl Ipc325\(kp\) Firmware
cpe:2.3:o:tp-link:tl-ipc325\(kp\)_firmware:*:*:*:*:*:*:*:*
Range: <1.0.21
TP-Link/Tl Ipc40a 4 Firmware
cpe:2.3:o:tp-link:tl-ipc40a-4_firmware:*:*:*:*:*:*:*:*
Range: <1.0.21
TP-Link/TL-IPCllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/yough3rt/IOT-pwn-for-fun/blob/master/TP-LINK-websys-Authenticated-RCEnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000