PT-2018-3320 · Tp Link · Tp-Link Tl-R600Vpn

CVE-2018-3948 · Publicado 2018-11-18 · Atualizado 2023-02-03

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TP-Link TL-R600VPN (affected versions not specified)

Description The issue is related to insufficient input validation in the URI parsing functionality of the TP-Link TL-R600VPN HTTP server. This can be exploited by a remote attacker to cause a denial-of-service by sending a specially crafted web request. The attack can be triggered with either an unauthenticated or authenticated request, leading to downtime for the management portal.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-04734

CVE-2018-3948

Produtos afetados

Tp-Link Tl-R600Vpn

Referências · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3948 · Nota de Segurança
• https://securitylab.ru/news/496578.php · Nota
• https://tp-link.com/us/support/download/tl-r600vpn · Nota
• https://osv.dev/vulnerability/CVE-2018-3948 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04734 · Nota de Segurança