Read the docs
TI-2023-02475 Aliases CVE-2023-2646GHSA-9jgc-88jp-p7rc

TP-Link Archer C7v2 GET Request Parameter denial of service

Priority LOW 29CWE-404Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-404.

Summary

A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component GET Request Parameter Handler. The manipulation leads to denial of service. The attack can only be done within the local network. The associated identifier of this vulnerability is VDB-228775. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00322 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkArcher C7v2v2_en_us_180114—No fix listedCNA
  • Archer C7v2 VendorTP-Link Affected v2_en_us_180114 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:archer_c7_firmware:180114:*:*:*:*:*:*:*180114VulnerableTP-Link
cpe:2.3:h:tp-link:archer_c7:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
  • cpe:2.3:o:tp-link:archer_c7_firmware:180114:*:*:*:*:*:*:* Versions 180114 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:archer_c7:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-2646
  2. 2026-10-03 Alias added: GHSA-9jgc-88jp-p7rc

References

—

  • TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
  • TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
  • TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
  • TI-2020-18081 A password-disclosure issue in the web interface on certain TP-Link devices allows a… CVSS 3.1CRITICAL 9.8
  • TI-2023-20381 OS command injection in TP-Link Archer C5 CVSS 3.1HIGH 8.0
  • TI-2026-04692 Use of weak cryptographic key in TP-Link Archer C7 CVSS 4.0MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences