CVE-2023-43318 is a high severity (CVSS 8.8) access control flaw in the TP-Link JetStream Smart Switch TL-SG2210P, version 5.0 Build 20211201. Changing the tid and usrlvl values in GET requests can raise privileges. The record names no fix, so check TP-Link and restrict management access to the switch.
What's affected
The record names one product and version: TP-Link JetStream Smart Switch TL-SG2210P hardware version 5.0, firmware build 20211201. It says attackers can escalate privileges by modifying the tid and usrlvl values in GET requests.
There is a source conflict to be aware of. The record describes the result as privilege escalation. The researcher's public write-up, which the record references, is titled improper access control and labels the result "Incorrect Access Control (DOS)", naming the usermanagement and swtmactablecfg endpoints. So the sources disagree on whether the main impact is escalation or denial of service. Either way, the affected build is the same.
I found no TP-Link advisory, and no fixed firmware version, in the sources I could read. The mailing list entry in the references loaded empty. The weakness is CWE-284, improper access control.
How to check if you're exposed
Log in to the switch's web interface and read the firmware version on the system information page. Then check how the switch management is exposed: which network segments can reach its web port, and whether it is reachable from user networks or from the internet.
nmap -p 80,443 192.0.2.10
Replace the address with your switch. The documentation address shown is a placeholder. Review the switch's configured accounts and its access log if it keeps one.
What to do now
- Find every TL-SG2210P in your estate and note its hardware and firmware version.
- Check TP-Link's support site for firmware newer than build 20211201 and install it if one exists.
- Move switch management to a dedicated management VLAN and block access from user networks.
- Disable the web interface if you manage the switch another way.
- Change management passwords and remove unused accounts.
- Back up the switch configuration before and after any change.
Why it matters
Network switches rarely get the same attention as servers, yet they carry all the traffic. A flaw that lets a signed in user change request values to gain rights is an access control failure: the device trusts values the client supplies. The class, CWE-284, covers that.
The vector in the record is network based and needs a low privilege account, with high impact on confidentiality, integrity and availability. Where the sources disagree on escalation or denial of service, plan for the worse case: someone with a login on the switch could change its configuration or disrupt it. The KEV flag is false.
Quick check
Do the sources agree on the impact?
Not fully. The record says privilege escalation. The researcher's write-up calls it incorrect access control with a denial of service label.
Sources
- GitHub write-up for CVE-2023-43318 (researcher, referenced in the record)
- Full Disclosure post, March 2024 (referenced in the record; content did not load when fetched)
Last reviewed: 19 October 2026.
