CVE-2021-3125

In TP-Link TL-XDR3230 < 1.0.12, TL-XDR1850 < 1.0.9, TL-XDR1860 < 1.0.14, TL-XDR3250 < 1.0.2, TL-XDR6060 Turbo < 1.1.8, TL-XDR5430 < 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.

• CWE-834

• https://service.tp-link.com.cn/detail_download_8719.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8720.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8722.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8723.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8724.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8725.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8719.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8720.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8722.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8723.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8724.htmlVendor Advisory
• https://service.tp-link.com.cn/detail_download_8725.htmlVendor Advisory

Published

Apr 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31233SQL Injection vulnerability found in Fighting Cock Informati…7.5
• CVE-2021-31239An issue found in SQLite SQLite3 v.3.35.4 that allows a remo…7.5
• CVE-2021-3124Stored cross-site scripting (XSS) in form field in robust.sy…5.4
• CVE-2021-31240An issue found in libming v.0.4.8 allows a local attacker to…7.8
• CVE-2021-31245omr-admin.py in openmptcprouter-vps-admin 0.57.3 and earlier…5.9
• CVE-2021-31249A CRLF injection vulnerability was found on BF-430, BF-431, …6.5
• CVE-2021-31250Multiple storage XSS vulnerabilities were discovered on BF-4…5.4
• CVE-2021-31251An authentication bypass in telnet server in BF-430 and BF43…9.8
• CVE-2021-31252An open redirect vulnerability exists in BF-630, BF-450M, BF…6.1
• CVE-2021-31254Buffer overflow in the tenc_box_read function in MP4Box in G…7.8
• CVE-2021-31255Buffer overflow in the abst_box_read function in MP4Box in G…7.8
• CVE-2021-31256Memory leak in the stbl_GetSampleInfos function in MP4Box in…5.5