PT-2023-3421 · Tp Link · Tp-Link Tl-Wr841N+3
Published
2023-06-21
·
Updated
2024-12-10
·
CVE-2023-36358
CVSS v3.1
7.7
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
TP-Link TL-WR940N versions V2 through V4
TP-Link TL-WR941ND versions V5 through V6
TP-Link TL-WR743ND version V1
TP-Link TL-WR841N version V8
Description
The issue is related to a buffer overflow in the /userRpm/AccessCtrlAccessTargetsRpm component. This allows attackers to cause a Denial of Service (DoS) via a crafted GET request to the "AccessCtrlAccessTargetsRpm" endpoint. The exploitation is tied to the
Changed parameter, which when improperly handled, can lead to a buffer overflow.Recommendations
For TP-Link TL-WR940N versions V2 through V4, consider disabling access to the /userRpm/AccessCtrlAccessTargetsRpm component until a patch is available.
For TP-Link TL-WR941ND versions V5 through V6, restrict the use of the
Changed parameter in the AccessCtrlAccessTargetsRpm component to minimize the risk of exploitation.
For TP-Link TL-WR743ND version V1, avoid using the /userRpm/AccessCtrlAccessTargetsRpm endpoint with crafted GET requests until the issue is resolved.
For TP-Link TL-WR841N version V8, limit access to the vulnerable component to prevent potential Denial of Service attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Resource Release
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tp-Link Tl-Wr743Nd
Tp-Link Tl-Wr841N
Tp-Link Tl-Wr940N
Tp-Link Tl-Wr941Nd