CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-46428
https://notcve.org/view.php?id=CVE-2022-46428
TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process. TP-Link TL-WR1043ND V1 3.13.15 y anteriores permite a atacantes autenticados ejecutar código arbitrario o provocar una Denegación de Servicio (DoS) mediante la carga de una imagen de firmware manipulada durante el proceso de actualización del firmware. • https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/S1hP34Hvj https://www.tp-link.com/us/press/security-advisory • CWE-494: Download of Code Without Integrity Check •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-2646
https://notcve.org/view.php?id=CVE-2013-2646
TP-LINK TL-WR1043ND V1_120405 devices contain an unspecified denial of service vulnerability. Los dispositivos TP-LINK TL-WR1043ND versión V1_120405, contienen una vulnerabilidad de denegación de servicio no especificada. • https://www.securityfocus.com/bid/59472 •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 2CVE-2018-16119
https://notcve.org/view.php?id=CVE-2018-16119
Stack-based buffer overflow in the httpd server of TP-Link WR1043nd (Firmware Version 3) allows remote attackers to execute arbitrary code via a malicious MediaServer request to /userRpm/MediaServerFoldersCfgRpm.htm. Un desbordamiento de búfer en la región stack de la memoria en el servidor httpd de TP-Link WR1043nd (versión de firmware 3), permite a los atacantes remotos ejecutar código arbitrario por medio de una petición maliciosa MediaServer a el archivo /userRpm/MediaServerFoldersCfgRpm.htm. • https://github.com/hdbreaker/CVE-2018-16119 http://tp-link.com https://www.secsignal.org/news/exploiting-routers-just-another-tp-link-0day • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2019-6972
https://notcve.org/view.php?id=CVE-2019-6972
An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks. Specifically, credentials in the "Authorization" cookie are encoded with URL encoding and base64, leading to easy decoding. Also, the username is cleartext, and the password is hashed with the MD5 algorithm (after decoding of the URL encoded string with base64). Se descubrió un problema en los dispositivos TP-Link TL-WR1043ND V2. • https://github.com/MalFuzzer/Vulnerability-Research/blob/master/TL-WR1043ND%20V2%20-%20TP-LINK/TL-WR1043ND_PoC.pdf https://twitter.com/MalFuzzer/status/1141269335685652480?s=19 • CWE-326: Inadequate Encryption Strength •
CVSS: 10.0EPSS: 3%CPEs: 2EXPL: 3CVE-2019-6971 – TP-Link TL-WR1043ND 2 - Authentication Bypass
https://notcve.org/view.php?id=CVE-2019-6971
An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router management web interface, and fully control the router without knowledge of the credentials. Se detecto un problema en los dispositivos TP-Link TL-WR1043ND V2. Un atacante puede enviar una cookie en un paquete de autenticación HTTP a la interfaz web de administración del enrutador y controlar completamente el enrutador sin el conocimiento de las credenciales. • https://www.exploit-db.com/exploits/47483 https://github.com/MalFuzzer/Vulnerability-Research/blob/master/TL-WR1043ND%20V2%20-%20TP-LINK/TL-WR1043ND_PoC.pdf https://twitter.com/MalFuzzer/status/1141269335685652480?s=19 •