CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-31659
https://notcve.org/view.php?id=CVE-2021-31659
TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the password of the switch to be modified and the configuration file to be tampered with. TP-Link TL-SG2005, TL-SG2008, etc. versiones 1.0.0 Build 20180529 Rel.40524 es vulnerable a taques de tipo Cross Site Request Forgery (CSRF). Toda la información de configuración se coloca en la URL, sin ninguna información adicional de autenticación de token. • http://tp-link.com https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31659 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 1CVE-2021-31658
https://notcve.org/view.php?id=CVE-2021-31658
TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application to crash, and all device configuration information will be erased. TP-Link TL-SG2005, TL-SG2008, etc. versiones 1.0.0 Build 20180529 Rel.40524 está afectado por un error de índice de matriz. La interfaz que proporciona la función "device description" sólo juzga la longitud de los datos recibidos, y no filtra los caracteres especiales. • http://tp-link.com https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31658 • CWE-129: Improper Validation of Array Index •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-17891
https://notcve.org/view.php?id=CVE-2020-17891
TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbitrary code. TP-Link Archer C1200 versiones de firmware 1.13 Build 24/01/2018 rel.52299 EU presenta una vulnerabilidad de tipo XSS permitiendo a un atacante remoto ejecutar código arbitrario • https://github.com/sandboxescape/TP-Link-wireless-router-Archer-C1200---Cross-Site-Scripting • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-26827
https://notcve.org/view.php?id=CVE-2021-26827
Buffer Overflow in TP-Link WR2041 v1 firmware for the TL-WR2041+ router allows remote attackers to cause a Denial-of-Service (DoS) by sending an HTTP request with a very long "ssid" parameter to the "/userRpm/popupSiteSurveyRpm.html" webpage, which crashes the router. Un desbordamiento de búfer en el firmware TP-Link WR2041 v1 para el enrutador TL-WR2041+, permite a atacantes remotos causar una denegación de servicio (DoS) mediante el envío de una petición HTTP con un parámetro "ssid" muy largo al "/userRpm/popupSiteSurveyRpm.html ", que bloquea el enrutador • https://github.com/GD008/vuln/blob/main/tplink_wr2041/tplink_WR2041pv1.md • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.3EPSS: 14%CPEs: 2EXPL: 1CVE-2021-29302
https://notcve.org/view.php?id=CVE-2021-29302
TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. The attack vector is: The attacker can get shell of the router by sending a message through the network, which may lead to remote code execution. TP-Link TL-WR802N (EE. UU.), Archer_C50v5_US v4_200 versiones 2020.06 incluyéndola, contiene una vulnerabilidad de desbordamiento de búfer en el proceso httpd en el cuerpo del mensaje. El vector de ataque es: el atacante puede obtener el shell del enrutador mediante el envío de un mensaje por medio de la red, lo que puede conllevar a una ejecución de código remota • https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-29302 https://static.tp-link.com/beta/2021/202103/20210319/TL-WR802Nv4_US_0.9.1_3.17_up_boot%5B210317-rel64474%5D.zip https://www.tp-link.com/us/support/download/tl-wr802n/#Firmware • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •