PT-2023-5331 · Tp Link · Tp-Link Er5120G

Published 2023-09-18 · Updated 2023-09-22 · CVE-2023-43135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-LINK ER5120G version 4.0 2.0.0 Build 210817 Rel.80868n

Description The issue is related to insufficient authentication procedures in the TP-LINK ER5120G router, allowing attackers to obtain sensitive device information without authentication, acquire user tokens, and ultimately log in to the device's backend management. This can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For TP-LINK ER5120G version 4.0 2.0.0 Build 210817 Rel.80868n, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

Information Disclosure

Improper Authentication

Weakness Enumeration

CWE-862

CWE-200

CWE-287

Related Identifiers

BDU:2023-05959

CVE-2023-43135

Affected Products

Tp-Link Er5120G

References · 10

• 🔥❌ https://github.com/7R4C4R/CVE/blob/main/TPLINK-TL-ER5120G/unauthorized%20access/Unauthorized%20Access%20Vulnerability.md · Exploit, Deleted
• https://bdu.fstec.ru/vul/2023-05959 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43135 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43135 · Security Note
• https://t.me/cvenotify/58234 · Telegram Post
• https://twitter.com/CVEnew/status/1704610921916842109 · Twitter Post
• https://t.me/cibsecurity/70865 · Telegram Post
• https://t.me/cvenotify/58372 · Telegram Post
• https://vuldb.com/?id.240106 · Note
• https://tp-link.com/ru/business-networking/load-balance-router/tl-er5120 · Note