CVE-2022-4498critical

CVE-2022-4498: falha crítica em TP-Link Archer C5

A vulnerable HTTP Basic Authentication process in TP-Link routers, Archer C5 and WR710N-V1, is susceptible to either a DoS or an arbitrary code execution via any interface.

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Archer C5+ Monitorar WR710N

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 1.9%
In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashing the httpd process) or an arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
TP-Link · Archer C5TP-Link · WR710N
CVEs relacionadas — TP-Link Archer C5

No mesmo produto, das mais perigosas para as menos.

CVE-2023-50224MEDIUMTP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure VulnerabilityEPSS 20.0%KEVCVE-2022-4499HIGHThe strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.EPSS 0.7%