CVE-2023-22303

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208' contains an authentication bypass vulnerability. Under the certain conditions, an attacker may impersonate an administrator of the product. As a result, information may be obtained and/or the product's settings may be altered with the privilege of the administrator.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
TP-Link	TP-Link SG105PE	firmware prior to 'TL-SG105PE(UN) 1.0_1.0.0 Build 20221208'

References

https://jvn.jp/en/jp/JVN78481846/index.htmlThird Party Advisory
https://www.tp-link.com/en/business-networking/easy-smart-switch/tl-sg105pe/Product, Vendor Advisory
https://www.tp-link.com/jp/support/download/tl-sg105pe/v1/#FirmwareProduct, Vendor Advisory
https://jvn.jp/en/jp/JVN78481846/index.htmlThird Party Advisory
https://www.tp-link.com/en/business-networking/easy-smart-switch/tl-sg105pe/Product, Vendor Advisory
https://www.tp-link.com/jp/support/download/tl-sg105pe/v1/#FirmwareProduct, Vendor Advisory

Timeline

Published: Jan 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-223048.0OS command injection vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker CVE-2023-223055.5Integer overflow in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of se CVE-2023-223067.2An OS command injection vulnerability exists in the libzebra.so bridge_group functionality of Milesight UR32L v32.3.0.5. A specially crafted CVE-2023-223075.5Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.4 allows local attacker to retrieve passwords via reading log fil CVE-2023-223087.5An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. A specially cra CVE-2023-223096.1Reflective Cross-Site-Scripting in Webconf in Tribe29 Checkmk Appliance before 1.6.4.CVE-2023-22319.8A vulnerability, which was classified as critical, was found in MAXTECH MAX-G866ac 0.4.1_TBRO_20160314. This affects an unknown part of the CVE-2023-223104.7Race condition in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of serv CVE-2023-223117.8Improper access control in some Intel(R) Optane(TM) PMem 100 Series Management Software before version 01.00.00.3547 may allow an authentica CVE-2023-223127.8Improper access control for some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via lo CVE-2023-223132.3Improper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user to potentially enable CVE-2023-223147.8Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information d