CVSS: 10.0EPSS: 94%CPEs: 2EXPL: 2CVE-2021-41653
https://notcve.org/view.php?id=CVE-2021-41653
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field. La función PING en el router TP-Link TL-WR840N EU versión v5 con firmware hasta TL-WR840N(EU)_V5_171211, es vulnerable a una ejecución de código remota por medio de una carga útil diseñada en un campo de entrada de dirección IP • https://github.com/likeww/CVE-2021-41653 http://tp-link.com https://k4m1ll0.com/cve-2021-41653.html https://www.tp-link.com/us/press/security-advisory • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.4EPSS: 0%CPEs: 2EXPL: 1CVE-2021-29280
https://notcve.org/view.php?id=CVE-2021-29280
In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow En el router inalámbrico N WR840N de TP-Link, un ataque de envenenamiento ARP puede causar un desbordamiento del búfer. • https://github.com/deadlysnowman3308/upgraded-ARP-Poisoning https://hackingvila.wordpress.com/2021/04/28/upgraded-arp-poisoning-tool • CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 1CVE-2021-38543
https://notcve.org/view.php?id=CVE-2021-38543
TP-Link UE330 USB splitter devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the USB splitter supplies power to some speakers. The power indicator LED of the USB splitter is connected directly to the power line, as a result, the intensity of the USB splitter's power indicator LED is correlative to its power consumption. The sound played by the connected speakers affects the USB splitter's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the USB splitter, we can recover the sound played by the connected speakers. • https://www.nassiben.com/glowworm-attack •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-28857
https://notcve.org/view.php?id=CVE-2021-28857
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie. TP-Link TL-WPA4220 Versión 4.0.2 Build 20180308 Rel.37064, un nombre de usuario y la contraseña son enviados por medio de la cookie • https://yunus-shn.medium.com/tp-links-tl-wpa4220-v4-0-cleartext-credentials-in-cookie-7516a2649394 • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-28858
https://notcve.org/view.php?id=CVE-2021-28858
TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 does not use SSL by default. Attacker on the local network can monitor traffic and capture the cookie and other sensitive information. TP-Link TL-WPA4220 versión 4.0.2 Build 20180308 Rel.37064 no usa SSL por defecto. El atacante en la red local puede monitorear el tráfico y capturar la cookie y otra información confidencial • https://yunus-shn.medium.com/tp-links-tl-wpa4220-v4-0-cleartext-transmission-of-sensitive-information-40357c778b84 • CWE-312: Cleartext Storage of Sensitive Information •