PT-2020-13041 · Tp Link · Tp-Link N210+6

Pietro Oliva · Published 2020-05-04 · Updated 2020-05-12 · CVE-2020-12110

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link NC200 version 2.1.9 build 200225 TP-Link N210 version 1.0.9 build 200304 TP-Link NC220 version 1.3.0 build 200304 TP-Link NC230 version 1.3.0 build 200304 TP-Link NC250 version 1.3.0 build 200304 TP-Link NC260 version 1.5.2 build 200304 TP-Link NC450 version 1.5.3 build 200304

Description The issue is related to a Hardcoded Encryption Key in certain TP-Link devices.

Recommendations For TP-Link NC200 version 2.1.9 build 200225, consider updating to a newer version. For TP-Link N210 version 1.0.9 build 200304, consider updating to a newer version. For TP-Link NC220 version 1.3.0 build 200304, consider updating to a newer version. For TP-Link NC230 version 1.3.0 build 200304, consider updating to a newer version. For TP-Link NC250 version 1.3.0 build 200304, consider updating to a newer version. For TP-Link NC260 version 1.5.2 build 200304, consider updating to a newer version. For TP-Link NC450 version 1.5.3 build 200304, consider updating to a newer version. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-12110

Affected Products

Tp-Link N210

Tp-Link Nc200

Tp-Link Nc220

Tp-Link Nc230

Tp-Link Nc250

Tp-Link Nc260

Tp-Link Nc450

References · 5

• 🔥 https://seclists.org/fulldisclosure/2020/May/3 · Exploit
• 🔥 http://packetstormsecurity.com/files/157532/TP-LINK-Cloud-Cameras-NCXXX-Hardcoded-Encryption-Key.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12110 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12110 · Vendor Advisory
• https://t.me/cvenotify/3518 · Telegram Post