PT-2017-18105 · Tp Link · Tp-Link Tl-Sg108E

Published 2017-04-23 · Updated 2019-10-03 · CVE-2017-8077

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749

Description The issue concerns a hard-coded ciphering key, which is a long string beginning with Ei2HNryt. This key is used for encryption purposes, but being hard-coded, it poses a security risk as it can be discovered and exploited by unauthorized parties.

Recommendations For TP-Link TL-SG108E version 1.0, consider updating the firmware to a version that does not contain the hard-coded ciphering key. For TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749, update the firmware to a newer version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2017-8077

Affected Products

Tp-Link Tl-Sg108E

References · 3

• 🔥 https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link · Exploit
• https://osv.dev/vulnerability/CVE-2017-8077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8077 · Security Note