CVE-2024-55211 : An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass aut

An issue in Think Router Tk-Rt-Wr135G V3.0.2-X000 allows attackers to bypass authentication via a crafted cookie.

Published 2025-04-17 18:15:48

Updated 2025-04-25 16:31:55

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2024-55211

Think » Tk-rt-wr135g Firmware » Version: 3.0.2-x000
cpe:2.3:o:think:tk-rt-wr135g_firmware:3.0.2-x000:*:*:*:*:*:*:*
Matching versions
When used together with: Think » Tk-rt-wr135g » Version: N/A

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 11 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2025-04-17
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-565 Reliance on Cookies without Validation and Integrity Checking

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Jump to