CVE-2021-41451

HighCVSS 7.5

Published: 17/12/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.38%

82th percentile - higher than 82% of all known CVEs

Summary

A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1_211117 allows a remote unauthenticated attacker to send a specially crafted HTTP request and receive a misconfigured HTTP/0.9 response, potentially leading into a cache poisoning attack.

Risk Assessment

The risk involves potential cache poisoning, which could allow an attacker to redirect users to malicious content or steal sensitive data without requiring authentication.

Recommendation

It is recommended to immediately update the TP-Link AX10v1 router firmware to version V1_211117 or later, which fixes this vulnerability.

Other vulnerabilities in TP-Link AX10v1

CVE-2021-41450High
An HTTP request smuggling vulnerability in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to perform a DoS attack on the web application by sending a specially crafted HTTP packet.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS