CVE-2018-16119

Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code via a malicious MediaServer request to /userRpm/MediaServerFoldersCfgRpm.htm.

CVSS v3.0

7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

34.13% chance of exploitation in the next 30 days, 98th percentile

Published

2019-06-20

Updated

2024-08-05

Proof-of-concept exploits (2)

• https://www.secsignal.org/news/exploiting-routers-just-another-tp-link-0day
• hdbreaker/CVE-2018-1611916★ · 2025-07-29

References

• CVE Record
• NVD entry

Related

• CVE-2011-4862
• CVE-2016-4622
• CVE-2018-16083
• CVE-2018-1612
• CVE-2018-16071
• CVE-2018-16130