CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-46914
https://notcve.org/view.php?id=CVE-2022-46914
20 Dec 2022 — An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image. Un problema en el proceso de actualización de firmware de TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 y anteriores permite a atacantes ejecutar código arbitrario o provocar una Denegación de Servicio (DoS) mediante la carga de una imagen de firmware manipulada. • https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJ4czlpwi •
CVSS: 6.1EPSS: 1%CPEs: 10EXPL: 4CVE-2021-3275 – TP-Link Cross Site Scripting
https://notcve.org/view.php?id=CVE-2021-3275
26 Mar 2021 — Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization. Se p... • https://packetstorm.news/files/id/161989 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 35%CPEs: 54EXPL: 3CVE-2020-35575 – TP-Link TL-WR841N Command Injection
https://notcve.org/view.php?id=CVE-2020-35575
26 Dec 2020 — A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices. Un problema de divulgación de contraseña en la interfaz web... • https://packetstorm.news/files/id/163274 •