PT-2019-12691 · Tp Link · Tp-Link Tl-Wr840N

Publicado 2019-05-24 · Atualizado 2019-05-29 · CVE-2019-12195

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840N version 5 00000005

Description The issue allows for cross-site scripting (XSS) attacks via the network name. An attacker must first gain access to the router by cracking the password and logging into the admin page. Once access is gained, an XSS payload can be used to automatically change the network name, resulting in the disconnection of the internet connection for all users.

Recommendations For TP-Link TL-WR840N version 5 00000005, consider changing the default password to a strong and unique one to prevent unauthorized access, and avoid using the network name field for any potentially malicious input until a fix is available. As a temporary workaround, restrict access to the admin login page to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-12195

Produtos afetados

Tp-Link Tl-Wr840N

Referências · 5

• 🔥 https://exploit-db.com/exploits/46882 · Exploit
• https://tp-link.com/us/security · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12195 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12195 · Aviso do Fabricante
• http://packetstormsecurity.com/files/153027/TP-LINK-TL-WR840N-Cross-Site-Scripting.html · Nota