CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2022-25073
https://notcve.org/view.php?id=CVE-2022-25073
TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). This vulnerability allows unauthenticated attackers to execute arbitrary code. Se ha detectado que los routers TL-WR841Nv14_US_0.9.1_4.18, contienen un desbordamiento de pila en la función dm_fillObjByStr(). Esta vulnerabilidad permite a atacantes no autenticados ejecutar código arbitrario • https://github.com/EPhaha/IOT_vuln/tree/main/TP-Link/TL-WR841N • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0162 – Vulnerability in TP-LinK TL-WR841N wireless router
https://notcve.org/view.php?id=CVE-2022-0162
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perform administrative operations on the affected device through web-based management interface. Se presenta una vulnerabilidad en el router inalámbrico TP-Link TL-WR841N versión V11 3.16.9 Build 160325 Rel.62500n, debido a una transmisión de información de autenticación en formato cleartextbase64. Una explotación con éxito de esta vulnerabilidad podría permitir a un atacante remoto interceptar las credenciales y posteriormente llevar a cabo operaciones administrativas en el dispositivo afectado mediante la interfaz de administración basada en web • https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0068 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 1CVE-2020-35576 – TP-Link TL-WR841N - Command Injection
https://notcve.org/view.php?id=CVE-2020-35576
A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577. Un problema de Inyección de Comando en la funcionalidad traceroute en TP-Link TL-WR841N V13 (JP) con versiones de firmware anteriores a 201216, permite a usuarios autenticados ejecutar código arbitrario como root por medio de metacaracteres de shell, una vulnerabilidad diferente a CVE-2018-12577 • https://www.exploit-db.com/exploits/50058 https://jvn.jp/en/vu/JVNVU92444096 https://www.tp-link.com/jp/support/download/tl-wr841n/v13/#Firmware https://www.tp-link.com/us/security • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 2CVE-2020-8423
https://notcve.org/view.php?id=CVE-2020-8423
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network. Un desbordamiento del búfer en el demonio httpd en los dispositivos TP-Link TL-WR841N versión V10 (versión de firmware 3.16.9), permite a un atacante remoto autenticado ejecutar código arbitrario por medio de una petición GET en la página para la configuración de la red Wi-Fi. • https://github.com/lnversed/CVE-2020-8423 https://ktln2.org/2020/03/29/exploiting-mips-router https://www.tp-link.com/us/security • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.3EPSS: 2%CPEs: 2EXPL: 0CVE-2019-17147 – TP-LINK TL-WR841N Web Service http_parser_main Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-17147
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Host request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. • https://www.tp-link.com/us/support/download/tl-wr841n/#Firmware https://www.zerodayinitiative.com/advisories/ZDI-19-992 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •