{"id":"CVE-2022-30075","published":"2022-06-09T00:59:47Z","modified":"2026-07-09T00:19:07Z","title":"In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is improper validation of imported backup files in the web interface of the TP-Link Router AX50, firmware 210730 and older. Using the web interface to import a malicious backup file can lead to remote code execution on the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:48Z"},"cvss":null,"epss":{"score":0.34626,"percentile":0.9842,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-11-26","exploitedFirstSeen":"2024-11-26","ransomware":false,"evidence":[{"url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","date":"2024-11-26"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://github.com/aaronsvk","tags":[]},{"url":"https://github.com/aaronsvk/CVE-2022-30075","tags":[]},{"url":"https://www.exploit-db.com/exploits/50962","tags":[]},{"url":"http://packetstormsecurity.com/files/167522/TP-Link-AX50-Remote-Code-Execution.html","tags":[]}],"techniques":[],"reports":[{"id":"SRC-ab60e18dfb72c1e085c0","title":"Matrix Unleashes A New Widespread DDoS Campaign","publisher":"aquasec.com","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","date":"2024-11-26","mentions":[{"quote":"However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).","start":7138,"end":7356},{"quote":"CVE-2022-30075: This CVE affects specific TP-Link routers, allowing unauthenticated users to manipulate configuration parameters, potentially injecting commands.","start":29663,"end":29824}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-35289","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-35289","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":50962,"url":"https://www.exploit-db.com/exploits/50962","title":"TP-Link Router AX50 firmware 210730 - Remote Code Execution (RCE) (Authenticated)","type":"remote","platform":"hardware","date":"2022-06-14","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-06-14"},"pocGithub":{"count":4,"skipped":0,"earliest":"2022-06-07","earliestUrl":"https://github.com/aaronsvk/CVE-2022-30075","repos":[{"name":"aaronsvk/CVE-2022-30075","url":"https://github.com/aaronsvk/CVE-2022-30075","stars":237,"created":"2022-06-07"},{"name":"SAJIDAMINE/CVE-2022-30075","url":"https://github.com/SAJIDAMINE/CVE-2022-30075","stars":3,"created":"2022-06-10"},{"name":"M4fiaB0y/CVE-2022-30075","url":"https://github.com/M4fiaB0y/CVE-2022-30075","stars":1,"created":"2022-09-12"},{"name":"RhestCorp/TP-L-NK-SIZMA-EXPLO-T","url":"https://github.com/RhestCorp/TP-L-NK-SIZMA-EXPLO-T","stars":1,"created":"2026-04-03"}]},"first":{"date":"2022-06-07","source":"PoC-in-GitHub","url":"https://github.com/aaronsvk/CVE-2022-30075"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/50962","http://packetstormsecurity.com/files/167522/TP-Link-AX50-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2022-06-07","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2022-06-14","url":"https://github.com/aaronsvk/CVE-2022-30075","provenance":"source"},{"date":"2022-06-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-30075","provenance":"source"},{"date":"2024-11-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","provenance":"source"},{"date":"2024-11-26","kind":"report","label":"Named in aquasec.com: Matrix Unleashes A New Widespread DDoS Campaign","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":63.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 705 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.68,"detail":"percentile 0.9842"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 2 NVD exploit links; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}