CVE-2023-49913 is a high severity (CVSS 7.2) stack-based buffer overflow in the web interface Radio Scheduling feature of the TP-Link EAP115. It is reached through the action parameter and needs an authenticated admin request. Talos says TP-Link released patched firmware in April 2024, so install it.
What's affected
The record describes the TP-Link N300 Wireless Access Point (EAP115 V4) running v5.0.4 Build 20220216. The overflow occurs in the httpd binary through the action parameter of the Radio Scheduling feature. The weaknesses are CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write).
The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The attacker needs a high privilege (administrator) login, which is why a remote code execution bug scores 7.2 and not higher. This is one of eight related CVEs from one Talos report, TALOS-2023-1888, that differ by parameter and model. The siblings for the EAP115 are CVE-2023-49910, CVE-2023-49911, CVE-2023-49912.
Fixed versions: Talos reports that TP-Link released patched firmware on 2024-04-03, with public disclosure on 2024-04-09, and links the vendor download pages. The report does not name the fixed build numbers, so check the TP-Link support page for your exact hardware revision. The record and Talos agree on the 7.2 score.
How to check if you're exposed
Read the firmware version in the EAP115 web interface under the system or firmware page, and match it against the build in the record, v5.0.4 Build 20220216. Also confirm the hardware revision, since firmware is specific to a revision.
The overflow needs an administrator session, so exposure depends on who can reach the management interface. Check whether it is reachable from guest networks or the internet, and who holds admin credentials. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every EAP115 access point and read its firmware build.
- Download the patched firmware from TP-Link's support page for your hardware revision and install it. Confirm the build after the reboot.
- Limit the management interface to a dedicated admin network or specific hosts.
- Change the administrator password to a unique one and remove unused admin accounts.
- Turn off remote management from the internet if it is on.
Why it matters
A stack-based overflow happens when input longer than a fixed buffer is copied into it, overwriting data next to it on the stack. In an embedded web server, that can end in code execution on the device. The action parameter is one of several inputs in the scheduling feature that skipped a length check.
Access points sit in the middle of your network traffic, so a compromised one is a useful foothold. The administrator login requirement lowers the odds, but shared or weak admin passwords are common on small deployments. This CVE is not on the CISA KEV list, and the sources I read report no exploitation.
Quick check
Does the attacker need to log in?
Yes. The record and Talos describe an authenticated request, and the vector requires high privileges.
Is a fixed firmware available?
Talos says TP-Link released patched firmware on 2024-04-03 but names no build numbers. Check TP-Link's support page.
Sources
Last reviewed: 19 October 2026.
