CVE-2024-2188 Overview
CVE-2024-2188 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the TP-Link Archer AX50 router running firmware version 1.0.11 build 2022052. An unauthenticated attacker can send a crafted Simple Object Access Protocol (SOAP) request to create a port mapping rule that embeds a malicious JavaScript payload. The payload executes in the context of the router administrative interface when a user loads the affected rule. Successful exploitation can lead to session hijacking, credential theft, or unauthorized changes to router configuration through the authenticated administrator's browser.
Critical Impact
Unauthenticated attackers can persistently inject JavaScript into the router's web management interface via SOAP-based port mapping rules, executing in the administrator's browser session.
Affected Products
- TP-Link Archer AX50 (hardware)
- TP-Link Archer AX50 firmware version 1.0.11 build 2022052
- Deployments exposing the router management interface or Universal Plug and Play (UPnP) SOAP endpoints
Discovery Timeline
- 2024-03-05 - CVE-2024-2188 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-2188
Vulnerability Analysis
The Archer AX50 exposes a SOAP interface used to manage port forwarding rules. The router accepts rule attributes without sanitizing HTML or JavaScript characters before storing them. When an administrator later loads the port mapping section of the web management interface, the router renders the stored attribute values directly into the Document Object Model (DOM). The injected script executes with the privileges of the authenticated administrative session.
The issue falls under CWE-79, Improper Neutralization of Input During Web Page Generation. The router lacks both input validation on the SOAP handler and output encoding on the rendering path. Because the SOAP request does not require authentication, an attacker on the network, or via cross-origin request forgery against a UPnP-exposed endpoint, can plant a persistent payload without credentials.
Root Cause
The firmware trusts client-supplied data from SOAP requests when persisting port mapping entries. Fields such as rule description or service name are stored verbatim and later reflected into the administrator's browser without contextual escaping. The unauthenticated access on the SOAP endpoint compounds the impact by removing the barrier of prior authentication.
Attack Vector
Exploitation proceeds in two stages. First, the attacker sends a crafted SOAP request to the router's UPnP service to create a port mapping rule where a stored field contains a JavaScript payload. Second, when an administrator logs into the router's web interface and navigates to the port forwarding view, the browser parses and executes the stored payload. User interaction is required to trigger execution, which aligns with the reflected script running in the victim admin's session.
No verified public exploit or proof-of-concept code is currently available. For additional technical context, see the INCIBE Security Notice on XSS in TP-Link Archer AX50.
Detection Methods for CVE-2024-2188
Indicators of Compromise
- Unexpected port mapping rules on the router containing HTML tags, <script> markers, javascript: URIs, or event handler attributes such as onerror and onload.
- Inbound SOAP requests to the router's UPnP endpoint from untrusted hosts on the local network.
- Administrator sessions issuing configuration changes shortly after loading the port forwarding page.
Detection Strategies
- Inspect stored router configuration exports for non-alphanumeric characters in rule name and description fields.
- Monitor HTTP and SOAP traffic to the router management interface for AddPortMapping or similar UPnP action calls originating from unexpected sources.
- Enable browser Content Security Policy (CSP) violation reporting on any management workstations that access router interfaces.
Monitoring Recommendations
- Log and alert on all administrative access to the Archer AX50 web interface and correlate with recent configuration changes.
- Segment router management traffic onto a dedicated VLAN and monitor for unauthorized SOAP or UPnP activity.
- Track firmware version inventory to identify devices still running 1.0.11 build 2022052.
How to Mitigate CVE-2024-2188
Immediate Actions Required
- Upgrade the Archer AX50 to the latest firmware available from TP-Link that supersedes 1.0.11 build 2022052.
- Disable UPnP on the router if it is not required for the deployment.
- Restrict access to the router's web management interface to trusted management hosts only.
Patch Information
No vendor advisory URL is listed in the NVD entry at the time of publication. Administrators should check the TP-Link support page for the Archer AX50 and apply the newest firmware release. Review the INCIBE Security Notice on XSS in TP-Link Archer AX50 for additional guidance.
Workarounds
- Disable UPnP under the advanced NAT forwarding settings to remove the unauthenticated SOAP entry point.
- Audit existing port mapping rules and delete any entry whose name or description contains HTML or scripting syntax.
- Access the router management interface from a hardened browser profile with scripting disabled for the router's IP address until firmware is patched.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
