An authenticated buffer handling flaw exists in the TP‑Link VIGI C485 V1 web API. The flaw stems from missing input sanitization, allowing memory corruption that can be exploited to execute arbitrary code with elevated privileges. This effect is limited to users who can authenticate to the device, but once authenticated, an attacker can gain complete control of the system.

The affected product is TP‑Link Systems Inc.’s VIGI C485 V1 router, running firmware version 1.0. The vulnerability is specifically noted in the web API exposed by this firmware release.

The CVSS score of 8.5 indicates high severity, yet the EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid administrative credentials and involves triggering a buffer overflow in the web API, which could allow the attacker to run arbitrary code and potentially escape the device’s sandbox.