PT-2018-3321 · Tp Link · Tp-Link Tl-R600Vpn

Published 2018-11-19 · Updated 2023-02-03 · CVE-2018-3951

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TP-Link TL-R600VPN (affected versions not specified)

Description A remote code execution issue exists in the HTTP header-parsing function of the TP-Link TL-R600VPN HTTP Server. This is caused by a buffer overflow when a specially crafted HTTP request is sent, allowing an attacker to execute arbitrary code on the device. The vulnerability can be triggered by sending an authenticated HTTP request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-04737

CVE-2018-3951

Affected Products

Tp-Link Tl-R600Vpn

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0620 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3951 · Security Note
• https://bdu.fstec.ru/vul/2019-04737 · Security Note
• https://securitylab.ru/news/496578.php · Note
• https://tp-link.com/us/support/download/tl-r600vpn · Note