{"id":"CVE-2021-3125","aliases":["EUVD-2021-26475","GHSA-w422-w3vf-f63f"],"status":"published","title":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL...","description":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL-XDR6060 Turbo \u003c 1.1.8, TL-XDR5430 \u003c 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.04452,"percentile":0.915,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-834"],"published":"2021-04-12T17:41:04Z","modified":"2026-06-17T04:04:42Z","products":[{"vendor":"tp-link","product":"tl-xdr1850_firmware"},{"vendor":"tp-link","product":"tl-xdr1860_firmware"},{"vendor":"tp-link","product":"tl-xdr3230_firmware"},{"vendor":"tp-link","product":"tl-xdr3250_firmware"},{"vendor":"tp-link","product":"tl-xdr5430_firmware"},{"vendor":"tp-link","product":"tl-xdr6060_firmware"}],"references":[{"url":"https://service.tp-link.com.cn/detail_download_8724.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://service.tp-link.com.cn/detail_download_8723.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://service.tp-link.com.cn/detail_download_8719.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://service.tp-link.com.cn/detail_download_8722.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://service.tp-link.com.cn/detail_download_8725.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://service.tp-link.com.cn/detail_download_8720.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3125"},{"url":"https://github.com/advisories/GHSA-w422-w3vf-f63f"}],"sources":{"cve":[{"id":"CVE-2021-3125","description":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL-XDR6060 Turbo \u003c 1.1.8, TL-XDR5430 \u003c 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.","status":"published","published":"2021-04-12T17:41:04Z","modified":"2024-08-03T16:45:51.234Z","updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26475","description":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL-XDR6060 Turbo \u003c 1.1.8, TL-XDR5430 \u003c 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.","status":"published","published":"2021-04-12T17:41:04Z","modified":"2024-08-03T16:45:51Z","updated_at":"2026-11-03T03:25:13.531128Z"}],"ghsa":[{"id":"GHSA-w422-w3vf-f63f","title":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL...","description":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL-XDR6060 Turbo \u003c 1.1.8, TL-XDR5430 \u003c 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.","status":"published","published":"2022-05-24T17:47:09Z","modified":"2023-01-29T05:07:13Z","cwes":["CWE-834"],"updated_at":"2026-11-02T14:46:09.625645Z"}],"nvd":[{"id":"CVE-2021-3125","description":"In TP-Link TL-XDR3230 \u003c 1.0.12, TL-XDR1850 \u003c 1.0.9, TL-XDR1860 \u003c 1.0.14, TL-XDR3250 \u003c 1.0.2, TL-XDR6060 Turbo \u003c 1.1.8, TL-XDR5430 \u003c 1.0.11, and possibly others, when IPv6 is used, a routing loop can occur that generates excessive network traffic between an affected device and its upstream ISP's router. This occurs when a link prefix route points to a point-to-point link, a destination IPv6 address belongs to the prefix and is not a local IPv6 address, and a router advertisement is received with at least one global unique IPv6 prefix for which the on-link flag is set.","status":"published","published":"2021-04-12T19:15:14.753Z","modified":"2026-06-17T04:04:42.6Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T14:06:51.610648Z"}]}}