PT-2018-3323 · Tp Link · Tp-Link Tl-R600Vpn

Published 2018-11-19 · Updated 2023-02-03 · CVE-2018-3949

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions TP-Link TL-R600VPN (affected versions not specified)

Description The issue is related to an information disclosure vulnerability in the HTTP server functionality. It can be triggered by a specially crafted URL, causing a directory traversal and resulting in the disclosure of sensitive system files. An attacker can exploit this by sending either an unauthenticated or an authenticated web request. The vulnerability is due to incorrect restriction of a directory path name with limited access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-04742

CVE-2018-3949

Affected Products

Tp-Link Tl-R600Vpn

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0618 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3949 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04742 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-3949 · Security Note
• https://securitylab.ru/news/496578.php · Note
• https://tp-link.com/us/support/download/tl-r600vpn · Note