PT-2014-8953 · Tp Link · Tp-Link Tl-Wr740N

Gjoko Krstic · Publicado 2014-12-08 · Atualizado 2017-09-08 · CVE-2014-9350

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR740N version 3.16.4 Build 130205 TP-Link TL-WR740N version 3.16.6 Build 130529 TP-Link TL-WR740N version 3.17.0 Build 140520

Description The issue allows remote attackers to cause a denial of service, resulting in an httpd crash. This can be achieved by exploiting a vector involving a "new" value in the isNew parameter to the "PingIframeRpm.htm" endpoint.

Recommendations For version 3.16.4 Build 130205, avoid using the isNew parameter in the "PingIframeRpm.htm" endpoint until the issue is resolved. For version 3.16.6 Build 130529, restrict access to the "PingIframeRpm.htm" endpoint to minimize the risk of exploitation. For version 3.17.0 Build 140520, consider disabling the httpd service temporarily until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

CVE-2014-9350

Produtos afetados

Tp-Link Tl-Wr740N

Referências · 7

• 🔥 http://exploit-db.com/exploits/35345 · Exploit
• 🔥 https://exploit-db.com/exploits/35345 · Exploit
• http://osvdb.org/115017 · Nota
• http://packetstormsecurity.com/files/129227/TP-Link-TL-WR740N-Denial-Of-Service.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9350 · Nota de Segurança
• http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5210.php · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98927 · Nota