Authenticated stored XSS in TP-Link TL-SG1016DE enables JavaScript execution in an administrator's browser

An authenticated stored cross-site scripting (XSS) exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016DE(UN) V7_1.0.1 Build 20240628.

• TP-Link TL-SG1016DE: The structured record marks the product affected for <= V7.6_1.0.0 Build 20230616; its custom version range uses 0 as the lower value and marks the default status as unaffected.
• Vendor-listed fixed firmware: TL-SG1016DE(UN)_V7_1.0.1 Build 20240628. TP-Link describes this build as fixing the XSS and RSA Key vulnerabilities.
• No additional hardware branch or parallel release branch is confirmed by the available evidence. The status of branches outside the stated range should not be inferred merely from the existence of this fixed build.

TP-Link TL-SG1016DE contains CWE-79 improper neutralization of input during web page generation. In a stored XSS condition, attacker-controlled content can be retained and later rendered without sufficient neutralization, allowing JavaScript to execute when the stored content is opened in an administrator's browser. The documented attack path requires network access, prior authentication with low privileges, and user interaction; the supplied assessment also identifies low attack complexity. The record does not identify the input field, endpoint, storage location, or specific internal module responsible for the flaw. The confirmed execution target is the administrator's browser, and the available evidence does not establish direct code execution in the switch firmware or service process.

• Reachability: The attack can be performed over the network.
• Authentication: An authenticated account with low privileges is required.
• Interaction: User interaction is required, with the documented victim context being an administrator's browser.
• Complexity: The supplied assessment identifies low attack complexity.
• Public status: The record marks a public exploit as available, and the SSVC data records exploitation as poc. No exploit name, payload, or exploit procedure is identified. This does not establish active exploitation in the wild.

The confirmed technical outcome is JavaScript execution in an administrator's browser after stored XSS content is rendered. This could enable manipulation of content or actions within the administrative browser context and could expose data available to that browser, although the practical result depends on session permissions and interface protections. The supplied assessment indicates low confidentiality and integrity impact, no availability impact, and a change of scope from the original application context to the victim browser. The evidence does not establish direct full control of the switch firmware or a device-wide outage.

JavaScript executing in an administrator's browser could alter page content, influence actions within an administrative session, or access data available to that browser, depending on the interface's permissions and protections. The supplied assessment indicates limited confidentiality and integrity impact and no direct availability impact. The administrator context makes the issue operationally relevant because the affected browser may be used to manage switch configuration or view sensitive information. The available evidence does not confirm a complete device takeover, a specific data breach, service disruption, or any named incident.

1. Inventory TL-SG1016DE(UN) devices and verify the hardware version before selecting firmware.
2. For devices within the affected range, upgrade to the exact firmware TL-SG1016DE(UN)_V7_1.0.1 Build 20240628, which TP-Link lists as fixing the XSS vulnerability. Do not treat this exact fix as proof that every other release branch is covered.
3. Obtain firmware from the official TP-Link website for the device's purchase region. TP-Link warns that using firmware for the wrong hardware version can damage the device and affect its warranty.
4. Do not power off the device during the upgrade. TP-Link also recommends using a wired connection where appropriate and stopping Internet applications or disconnecting the device's Internet line during the update.
5. Verify the firmware string and review the management interface after the upgrade. No vendor-specific interim mitigation is identified in the available evidence; until patching is possible, restrict management access to trusted administrative networks as a precaution rather than as a confirmed vendor mitigation.

1. Inventory all deployed TL-SG1016DE(UN) devices and record each hardware version and firmware string.
2. Compare firmware against the affected boundary in the record, especially TL-SG1016DE(UN) V7.6_1.0.0 Build 20230616 and earlier versions covered by the published range.
3. After remediation, verify the device-reported firmware string and confirm that it is V7_1.0.1 Build 20240628.
4. Review the management interface and browser telemetry for unexpected page content, unexpected JavaScript behavior, or changes in pages routinely opened by administrators. This is precautionary monitoring, not a vendor-confirmed indicator.
5. Review authentication and management-access activity for anomalies as an additional precaution. No specific endpoint, log event, or IOC is provided, and the absence of suspicious logs does not prove that a device is safe.