CVE-2023-49134 is a high severity (CVSS 8.1) command execution flaw in the TDDP enable_test_mode feature of TP-Link access points, here affecting uclited on the EAP115 V4, firmware 5.0.4 Build 20220216. Unauthenticated packets can trigger it. We could not confirm a fixed firmware, so check TP-Link and isolate management access.
What's affected
- TP-Link AC1350 EAP225 V3 firmware 5.1.0 Build 20220926 and N300 EAP115 V4 firmware 5.0.4 Build 20220216 are named in the record's description.
- This entry concerns uclited on the EAP115 V4, firmware 5.0.4 Build 20220216. CVE-2023-49133 is the matching entry for the other model.
- The record says a specially crafted series of network requests, sent as unauthenticated packets, can lead to arbitrary command execution.
- Fixed version: not confirmed. The record's references are Cisco Talos report TALOS-2023-1862, which we could not open. Check the TP-Link support page.
- The vector marks attack complexity as high, which is why the score is 8.1 and not higher.
- Severity: the record gives CVSS 8.1, which is high. KEV status: the record shows kev as false, and none of the sources we read report exploitation in the wild.
The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Read plainly, it describes an attack over the network, with high attack complexity, requiring no privileges and no user interaction. Impact on confidentiality is high, on integrity high and on availability high. The scope is unchanged, so the impact stays within the vulnerable component.
How to check if you're exposed
Read the firmware version for each EAP225 V3 and EAP115 V4 from the admin page or your management controller, and compare it with the latest release for the model on TP-Link's support site.
Then check network placement. The attack uses network packets to a service on the device, so what matters is which machines can reach the access point's management address. If user and guest devices can reach it, that is the exposure.
Record model, hardware revision and firmware for every access point you manage.
What to do now
- Look for newer firmware for the model on TP-Link's support site, and apply it if one is listed.
- Place access point management on a dedicated VLAN with firewall rules that block users and guests.
- Disable any management service you do not use, if the interface allows it.
- Watch for unexpected configuration changes or unknown outbound connections from access points.
- Replace the device if it no longer receives updates.
Why it matters
The record lists CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-77 (Command Injection). In plain terms, a test mode feature accepted input that ended up being run as a command on the device. Commands on an access point run with high rights, so an attacker who succeeds can alter configuration, intercept or redirect traffic, or use the device as a foothold.
The unauthenticated, network based nature is serious, and the high attack complexity is the main reason the score is not higher. Even so, network gear is often forgotten after installation. Treat access points as servers that need patching and segmentation.
Quick check
How is CVE-2023-49134 different from CVE-2023-49133?
They describe the same feature on two models. This entry covers the model in the title, and the other covers its counterpart.
Is a fix available?
We could not confirm one from the sources we could open. Check TP-Link's support page for your model and hardware revision.
Sources
Last reviewed: 19 October 2026.
