Details of VAR-201806-1890

ID

VAR-201806-1890

TITLE

Code Execution Vulnerability in TP-Link Enterprise Router (CNVD-2018-08408)

Trust: 0.6

sources: CNVD: CNVD-2018-08408

DESCRIPTION

Tplink ER5110G, Tplink ER5120G and Tplink WAR1300L are all enterprise VPN routers and enterprise wireless VPN routers. A code execution vulnerability exists in the TP-Link enterprise router. An attacker can use the vulnerability to obtain the administrator username and password of the router, or hijack a session (get session stok).

Trust: 0.6

sources: CNVD: CNVD-2018-08408

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-08408

AFFECTED PRODUCTS

vendor:	tplink	model:	er5110g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er5120g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er5510g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er5520g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6110g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6120g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6510g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er6520g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	er7520g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r4149g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r4239g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r4299g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473g-ac	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r473gp-ac	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r478g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r478g	scope:	eq	version:	+	Trust: 0.6
vendor:	tplink	model:	r483	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	r488	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war1300l	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war1750l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war2600l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war302	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war450	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war450l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war458	scope:	-	version:	-	Trust: 0.6
vendor:	tuplink	model:	war458l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	war900l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr1300l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr1750l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr2600l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr300	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr302	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr4300l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr450	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr450l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr458l	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr900g	scope:	-	version:	-	Trust: 0.6
vendor:	tplink	model:	wvr900l	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2018-08408

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2018-08408
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2018-08408
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:A/AC:H/AU:S/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	2.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2018-08408

PATCH

title:

Code Execution Vulnerability in TP-Link Enterprise Router (CNVD-2018-08408)

url:

https://www.cnvd.org.cn/patchinfo/show/125961

Trust: 0.6

sources: CNVD: CNVD-2018-08408

EXTERNAL IDS

db:

CNVD

id:

CNVD-2018-08408

Trust: 0.6

sources: CNVD: CNVD-2018-08408

SOURCES

db:

CNVD

id:

CNVD-2018-08408

LAST UPDATE DATE

2022-05-04T09:03:58.503000+00:00

SOURCES UPDATE DATE

db:

CNVD

id:

CNVD-2018-08408

date:

2018-04-27T00:00:00

SOURCES RELEASE DATE

db:

CNVD

id:

CNVD-2018-08408

date:

2018-06-04T00:00:00