PT-2025-1309 · Tp Link · Tp-Link Tl-Sg108E

Error404Unknown · Published 2025-01-27 · Updated 2025-07-16 · CVE-2025-0730

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E versions 1.0.0 Build 20201208 Rel. 40304

Description A problematic vulnerability exists in the TP-Link TL-SG108E, affecting an unknown function within the /usr account set.cgi file of the HTTP GET Request Handler component. Manipulation of the username/password arguments in a GET request with sensitive query strings can lead to information disclosure. The attack is possible remotely, though considered complex and difficult to exploit. The exploit has been publicly disclosed.

Recommendations TP-Link TL-SG108E versions prior to 1.0.0 Build 20250124 Rel. 54920 (Beta) should be upgraded to version 1.0.0 Build 20250124 Rel. 54920 (Beta) to address this issue.

Exploit

Fix

Weakness Enumeration

CWE-598

Related Identifiers

BDU:2025-00944

CVE-2025-0730

Affected Products

Tp-Link Tl-Sg108E

References · 15

• 🔥 https://github.com/TheCyberDiver/Public-Disclosures-CVE-/blob/main/tp-link%20sensitive%20info%20in%20GET.md · Exploit
• https://bdu.fstec.ru/vul/2025-00944 · Security Note
• https://osv.dev/vulnerability/CVE-2025-0730 · Vendor Advisory
• https://static.tp-link.com/upload/beta/2025/202501/20250124/TL-SG108E(UN)%206.0_1.0.0%20Build%2020250124%20Rel.54920(Beta)_up.zip · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-0730 · Security Note
• https://twitter.com/WolfgangSesin/status/1883827588163895420 · Twitter Post
• https://twitter.com/CVEnew/status/1883926122326335579 · Twitter Post
• https://twitter.com/CsAhmedmansour/status/1886153286782161191 · Twitter Post
• https://vuldb.com/?submit.478465 · Note
• https://vuldb.com/?id.293508 · Note
• https://vuldb.com/?ctiid.293508 · Note
• https://t.me/cvenotify/129108 · Telegram Post
• https://tp-link.com · Note
• https://t.me/cvedetector/16497 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1883827588407144783 · Twitter Post