PT-2014-8953 · Tp Link · Tp-Link Tl-Wr740N

Gjoko Krstic · Published 2014-12-08 · Updated 2017-09-08 · CVE-2014-9350

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR740N version 3.16.4 Build 130205 TP-Link TL-WR740N version 3.16.6 Build 130529 TP-Link TL-WR740N version 3.17.0 Build 140520

Description The issue allows remote attackers to cause a denial of service, resulting in an httpd crash. This can be achieved by exploiting a vector involving a "new" value in the isNew parameter to the "PingIframeRpm.htm" endpoint.

Recommendations For version 3.16.4 Build 130205, avoid using the isNew parameter in the "PingIframeRpm.htm" endpoint until the issue is resolved. For version 3.16.6 Build 130529, restrict access to the "PingIframeRpm.htm" endpoint to minimize the risk of exploitation. For version 3.17.0 Build 140520, consider disabling the httpd service temporarily until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2014-9350

Affected Products

Tp-Link Tl-Wr740N

References · 7

• 🔥 http://exploit-db.com/exploits/35345 · Exploit
• 🔥 https://exploit-db.com/exploits/35345 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-9350 · Security Note
• http://osvdb.org/115017 · Note
• http://packetstormsecurity.com/files/129227/TP-Link-TL-WR740N-Denial-Of-Service.html · Note
• http://zeroscience.mk/en/vulnerabilities/ZSL-2014-5210.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98927 · Note