CVE-2026-1457

An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution. Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with elevated privileges.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/vigi-c385/v1/#Firmware	Product
https://www.tp-link.com/kr/support/download/vigi-c385/v1/#Firmware	Product
https://www.tp-link.com/us/support/faq/4931/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:vigi_c385_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:vigi_c385:1.0:*:*:*:*:*:*:*

History

09 Mar 2026, 17:36

Type	Values Removed	Values Added
CPE		cpe:2.3:o:tp-link:vigi_c385_firmware:::::::: cpe:2.3:h:tp-link:vigi_c385:1.0:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
First Time		Tp-link Tp-link vigi C385 Tp-link vigi C385 Firmware
Summary		(es) Una falla autenticada en el manejo de búfer en la API web de TP-Link VIGI C385 V1 que carece de saneamiento de entrada, puede permitir la corrupción de memoria lo que lleva a la ejecución remota de código. Atacantes autenticados pueden desencadenar un desbordamiento de búfer y potencialmente ejecutar código arbitrario con privilegios elevados.
References	~~() https://www.tp-link.com/en/support/download/vigi-c385/v1/#Firmware -~~	() https://www.tp-link.com/en/support/download/vigi-c385/v1/#Firmware - Product
References	~~() https://www.tp-link.com/kr/support/download/vigi-c385/v1/#Firmware -~~	() https://www.tp-link.com/kr/support/download/vigi-c385/v1/#Firmware - Product
References	~~() https://www.tp-link.com/us/support/faq/4931/ -~~	() https://www.tp-link.com/us/support/faq/4931/ - Vendor Advisory

29 Jan 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-29 19:16

Updated : 2026-03-09 17:36

NVD link : CVE-2026-1457

Mitre link : CVE-2026-1457

CVE.ORG link : CVE-2026-1457

JSON object : View

Products Affected

tp-link

vigi_c385_firmware
vigi_c385

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-1457", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-01-29T19:16:19.160", "references": [{"url": "https://www.tp-link.com/en/support/download/vigi-c385/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/kr/support/download/vigi-c385/v1/#Firmware", "tags": ["Product"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/4931/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corruption leading to remote code execution.\u00a0Authenticated attackers may trigger buffer overflow and potentially execute arbitrary code with elevated privileges."}, {"lang": "es", "value": "Una falla autenticada en el manejo de b\u00fafer en la API web de TP-Link VIGI C385 V1 que carece de saneamiento de entrada, puede permitir la corrupci\u00f3n de memoria lo que lleva a la ejecuci\u00f3n remota de c\u00f3digo. Atacantes autenticados pueden desencadenar un desbordamiento de b\u00fafer y potencialmente ejecutar c\u00f3digo arbitrario con privilegios elevados."}], "lastModified": "2026-03-09T17:36:37.653", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:vigi_c385_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11807C33-1B2F-4AB8-99A0-DE2C970B84DD", "versionEndExcluding": "3.1.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:vigi_c385:1.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AA16D189-938C-46FF-B66A-1F41CC3BDEAC"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}