CVE-2019-19143 : TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace th

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI.

Published 2020-01-27 19:15:11

Updated 2023-02-01 15:19:48

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2019-19143

Tp-link » Tl-wr849n Firmware » Version: 0.9.1 4.16
cpe:2.3:o:tp-link:tl-wr849n_firmware:0.9.1_4.16:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Tl-wr849n » Version: N/A

EPSS FAQ

0.38%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.1	MEDIUM	AV:A/AC:L/Au:S/C:P/I:P/A:N	5.1	4.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N	0.9	5.2	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

http://packetstormsecurity.com/files/156586/TP-Link-TL-WR849N-0.9.1-4.16-Authentication-Bypass.html

TP-Link TL-WR849N 0.9.1 4.16 Authentication Bypass ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://fireshellsecurity.team/hack-n-routers/

Hack ‘N’ Routers - Vulnerabilidades comuns em roteadores domésticos - [PT-BR] | FireShell Security Team
Exploit;Third Party Advisory

CVEs referencing this url

Jump to