CVE-2023-49074 is a high severity (CVSS 7.4) denial of service flaw in the TDDP service of the TP-Link EAP225 V3 access point, firmware 5.1.0. A specially crafted series of network requests can reset the device to factory settings. We could not confirm a fixed firmware, so check TP-Link.
What's affected
- TP-Link AC1350 Wireless MU-MIMO Gigabit Access Point EAP225 V3, firmware 5.1.0 Build 20220926, per the NVD record.
- The flaw sits in the TDDP functionality. The record says unauthenticated packets can trigger a reset to factory settings.
- Fixed version: not confirmed. The only references in the record are Cisco Talos report TALOS-2023-1861, which we could not open. Check the TP-Link support site for the model.
- The vector marks attack complexity as high, and impact as high for integrity and availability.
- Severity: the record gives CVSS 7.4, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H. Read plainly, it describes an attack over the network, with high attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is none, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Log in to the access point's admin interface or the controller you use, and read the firmware version for each EAP225 V3. Compare it with the latest release on the TP-Link support page for the model. The record names 5.1.0 Build 20220926.
Also check where the access points sit. The attack needs network access to the device's management side, so check whether management interfaces share a network with ordinary users or guests.
Keep a list of model, hardware revision and firmware for each access point, because TP-Link advisories are specific to the hardware revision.
What to do now
- Check the TP-Link support page for a firmware newer than 5.1.0 Build 20220926 for the EAP225 V3, and apply it if one exists.
- Put access point management on a separate management VLAN that guests and users cannot reach.
- Back up the access point configuration so a reset can be recovered quickly.
- Monitor for access points that unexpectedly return to default settings or default network names.
- Replace the device if it is out of support and no fix is published.
Why it matters
The class is CWE-749 (Exposed Dangerous Method or Function). A function that should not be reachable by an unauthenticated network caller was exposed. A reset to factory settings does not give an attacker data, but it removes your configuration, drops clients and can leave the device in a default, less secure state until someone reconfigures it.
For an office, the effect is an outage that is hard to trace, because the device is up but wrongly configured. The remedy is as much about network design as patching: management interfaces should be reachable only from a small trusted segment.
Quick check
Does this give an attacker control of the device?
The record describes a reset to factory settings, with high integrity and availability impact. It does not describe code execution for this CVE.
Where can I read the Talos report?
The record links TALOS-2023-1861. We could not retrieve it, so this post relies on the record.
Sources
Last reviewed: 19 October 2026.
