CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-25074
https://notcve.org/view.php?id=CVE-2022-25074
TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code. Se ha detectado que los routers TP-Link TL-WR902AC(US)_V3_191209, contienen un desbordamiento de pila en la función DM_ Fillobjbystr(). Esta vulnerabilidad permite a atacantes no autenticados ejecutar código arbitrario • https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR902AC • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 1CVE-2022-25072
https://notcve.org/view.php?id=CVE-2022-25072
TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). This vulnerability allows unauthenticated attackers to execute arbitrary code. Se ha detectado que los routers TP-Link Archer A54(US)_V1_210111, contienen un desbordamiento de pila en la función DM_ Fillobjbystr(). Esta vulnerabilidad permite a atacantes no autenticados ejecutar código arbitrario • https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/Archer%20A54 • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-25073
https://notcve.org/view.php?id=CVE-2022-25073
TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated attackers to execute arbitrary code. Se ha detectado que los routers TL-WR841Nv14_US_0.9.1_4.18, contienen un desbordamiento de pila en la función dm_fillObjByStr(). Esta vulnerabilidad permite a atacantes no autenticados ejecutar código arbitrario • https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR841N • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2022-24972 – TP-Link TL-WR940N httpd Improper Access Control Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-24972
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper access control. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. • https://www.zerodayinitiative.com/advisories/ZDI-22-405 • CWE-284: Improper Access Control •
CVSS: 8.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0650 – TP-Link TL-WR940N httpd newBridgessid Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-0650
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://www.zerodayinitiative.com/advisories/ZDI-22-407 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •