PT-2018-3320 · Tp Link · Tp-Link Tl-R600Vpn

Published 2018-11-18 · Updated 2023-02-03 · CVE-2018-3948

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TP-Link TL-R600VPN (affected versions not specified)

Description The issue is related to insufficient input validation in the URI parsing functionality of the TP-Link TL-R600VPN HTTP server. This can be exploited by a remote attacker to cause a denial-of-service by sending a specially crafted web request. The attack can be triggered with either an unauthenticated or authenticated request, leading to downtime for the management portal.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-04734

CVE-2018-3948

Affected Products

Tp-Link Tl-R600Vpn

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0617 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3948 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3948 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04734 · Security Note
• https://securitylab.ru/news/496578.php · Note
• https://tp-link.com/us/support/download/tl-r600vpn · Note