CVE-2022-4499: falha de alta gravidade em TP-Link Archer C5
The strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.7%
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEs relacionadas — TP-Link Archer C5
No mesmo produto, das mais perigosas para as menos.
CVE-2023-50224MEDIUMTP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure VulnerabilityEPSS 20.0%KEVCVE-2022-4498CRITICALA vulnerable HTTP Basic Authentication process in TP-Link routers, Archer C5 and WR710N-V1, is susceptible to either a DoS or an arbitrary code execution via any interface.EPSS 1.9%