PT-2018-3323 · Tp Link · Tp-Link Tl-R600Vpn

CVE-2018-3949 · Publicado 2018-11-19 · Atualizado 2023-02-03

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions TP-Link TL-R600VPN (affected versions not specified)

Description The issue is related to an information disclosure vulnerability in the HTTP server functionality. It can be triggered by a specially crafted URL, causing a directory traversal and resulting in the disclosure of sensitive system files. An attacker can exploit this by sending either an unauthenticated or an authenticated web request. The vulnerability is due to incorrect restriction of a directory path name with limited access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2019-04742

CVE-2018-3949

Produtos afetados

Tp-Link Tl-R600Vpn

Referências · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0618 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3949 · Aviso do Fabricante
• https://securitylab.ru/news/496578.php · Nota
• https://tp-link.com/us/support/download/tl-r600vpn · Nota
• https://bdu.fstec.ru/vul/2019-04742 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-3949 · Nota de Segurança