Is it safe to install beta firmware that isn't listed on the support page but CVE? (TL-SG108E)
It’s been reported that the TL-SG108E has a security vulnerability, and a firmware update to address it is listed on the CVE database, as you may know.
However, this beta firmware version(TL-SG108E(UN) 6.0_1.0.0 Build 20250124 Rel.54920(Beta)) isn’t available on the support page, but link on CVE and so I’m unsure whether it’s safe to install it.
Based on the filename, the file I downloaded from the URL listed on CVE appears to be for the V6 model I’m using, so I think it should be safe to update with this but could anyone please give me some advice?
By the way, why does TP-Link keep posting outdated firmware versions and not place the beta versions or new fixed version in an easily accessible location? I just can't understand why.
Dear Sir,
As you can see on the page of CVE 2025-0729 on NIST's National Vulnerability Database.
(Somehow this board reject me to write url, so please google with this keyword.)
It says
"A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to clickjacking. The attack may be initiated remotely. Upgrading to version 1.0.0 Build 20250124 Rel. 54920(Beta) is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early. They reacted very professional and provided a pre-fix version for their customers."
and gives the updated beta firmware' s URL.
"https://static.tp-link.com/upload/beta/2025/202501/20250124/TL-SG108E(UN)%206.0_1.0.0%20Build%2020250124%20Rel.54920(Beta)_up.zip"
I also attach the capture from that page, so please take a look.
Thanks in advance.
shizuka2
