CVE-2023-43318

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
tp-link	tl-sg2210p	v5.0 Build 20211201

References

https://github.com/str2ver/CVE-2023-43318/tree/mainThird Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Mar/9
https://github.com/str2ver/CVE-2023-43318/tree/mainThird Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/9Mailing List, Third Party Advisory

Timeline

Published: Mar 6, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-433196.1Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts o CVE-2023-43327.5Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file CVE-2023-433208.8An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.CVE-2023-433218.8File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the w CVE-2023-433228.8ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v CVE-2023-433236.5mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to ex CVE-2023-433256.1A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user'CVE-2023-433266.1A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session co CVE-2023-43335.5Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server CVE-2023-433315.4A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or H CVE-2023-433368.8Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modif CVE-2023-433389.8Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability