PT-2021-19465 · Tp Link · Tp-Link Tl-Sg2005+1

Liyansong2018 · Published 2021-06-10 · Updated 2021-06-23 · CVE-2021-31659

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link TL-SG2005 version 1.0.0 Build 20180529 Rel.40524 TP-Link TL-SG2008 version 1.0.0 Build 20180529 Rel.40524

Description The issue allows for Cross Site Request Forgery (CSRF) attacks. Since all configuration information is placed in the URL without additional token authentication, a malicious link opened by the switch administrator can lead to the modification of the switch's password and tampering with the configuration file.

Recommendations For TP-Link TL-SG2005 version 1.0.0 Build 20180529 Rel.40524, avoid using links from untrusted sources to prevent potential CSRF attacks. For TP-Link TL-SG2008 version 1.0.0 Build 20180529 Rel.40524, avoid using links from untrusted sources to prevent potential CSRF attacks. As a temporary workaround, consider restricting access to the switch's configuration interface until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-31659

Affected Products

Tp-Link Tl-Sg2005

Tp-Link Tl-Sg2008

References · 4

• 🔥 https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31659 · Exploit
• http://tp-link.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31659 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31659 · Vendor Advisory