Improper access control in TP-Link JetStream Smart Switch TL-SG2210P enables privilege escalation

TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrlvl' values in GET requests.

• TP-Link JetStream Smart Switch TL-SG2210P firmware 5.0 Build 20211201 is identified as affected.
• The public disclosure states that the vendor released fixed firmware TL-SG2210P(UN)_V5.20_5.20.1 Build 20240202.
• The available evidence does not establish the status of other hardware revisions, regional firmware variants, or parallel release branches; do not infer that every later release is fixed.

TP-Link JetStream Smart Switch TL-SG2210P has an improper access control flaw in its web console. The affected endpoints are usermanagement and swtmactablecfg; the attacker-controlled values are tid and usrlvl in GET requests. Modifying these values can result in privilege escalation, indicating that authorization checks do not correctly bind access to the current role or session.

The record indicates a network-reachable attack path that requires low initial privileges, no user interaction, and low complexity. The authorization logic, accepted parameter semantics, and target role after escalation are not disclosed. The available evidence also does not establish that the initial access is unauthenticated.

• Reachability: Remote exploitation through the device's web console.
• Preconditions: The record indicates that the attacker needs low privileges; no user interaction is required and the attack complexity is low.
• Public exploitation: The record does not mark a public exploit, and the public disclosure lists Exploit/POC as N/A. This does not prove that exploitation is impossible or that the flaw has never been exploited in practice.
• Limits: No evidence identifies a campaign, victim, payload, or specific exploit chain.

Successful exploitation could move a low-privileged account or session to a higher privilege level on the affected switch. With unchanged scope, the primary consequences remain within the device component, but they may still include loss of confidentiality for management data, unauthorized configuration changes, and availability impact to network services.

The specific functions available after escalation, including which administrative operations could be abused, are not disclosed. Therefore, checking a single endpoint should not be treated as sufficient to exclude the full impact of the flaw.

The confirmed outcome is privilege escalation on the device. The supplied impact assessment indicates that successful exploitation could seriously affect the confidentiality, integrity, and availability of the device.

Higher privileges could plausibly enable access to management data, unauthorized configuration changes, or disruption of switching operations, but those specific capabilities are not confirmed by the public technical detail. Devices managed from broad or untrusted networks present greater operational exposure because the attack path is remotely reachable.

1. Upgrade affected devices to the exact fixed firmware TL-SG2210P(UN)_V5.20_5.20.1 Build 20240202, as stated in the public disclosure.
2. After upgrading, verify that the installed firmware and build match the fixed release and review administrative accounts, roles, and configuration.
3. Until an upgrade is possible, limit the web console to trusted administration networks, block access from the Internet or unnecessary network zones, and use a controlled administrative access path. This is temporary exposure reduction, not a vendor-confirmed fix.
4. Do not treat another firmware version or a parallel release branch as fixed without direct vendor confirmation or equivalent supporting evidence.

1. Inventory TP-Link JetStream Smart Switch TL-SG2210P devices and verify the firmware and build currently installed.
2. Identify devices that expose the web console to untrusted networks or to networks broader than the required administration scope.
3. If web-console logging is available, review GET requests to usermanagement and swtmactablecfg, especially when tid or usrlvl contains unusual values or changes outside normal administration activity.
4. Review account and role changes, switch-configuration changes, and login events after suspicious requests.
5. These checks are investigation leads rather than confirmed IOCs; the available evidence does not provide a definitive log pattern or indicator.