CVE-2021-31658

HighCVSS 8.1

Published: 10/06/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.02%

59th percentile - higher than 59% of all known CVEs

Summary

TP-Link TL-SG2005, TL-SG2008, etc. running firmware version 1.0.0 Build 20180529 Rel.40524 are affected by an array index error. The interface providing the "device description" function only checks the length of received data without filtering special characters. This vulnerability causes the application to crash and erases all device configuration information.

Risk Assessment

An attacker can remotely crash the switch and wipe all configuration settings, leading to network outages and requiring manual device reconfiguration.

Recommendation

Immediately update the firmware of affected TP-Link switches to the latest available version that fixes this vulnerability. If no update is available, restrict management interface access to trusted networks only.

Other vulnerabilities in TP-Link TL-SG2005/TL-SG2008

CVE-2021-31659High
CSRF vulnerability in TP-Link TL-SG2005, TL-SG2008, etc. switches with firmware version 1.0.0 Build 20180529 Rel.40524. All configuration data is placed in the URL without any additional token authentication, allowing an attacker to use a malicious link to change the password and tamper with the configuration file.

Original NVD description (English source)

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application to crash, and all device configuration information will be erased.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS