Sign-up

ID

VAR-201912-1997


CVE

CVE-2019-7405


TITLE

TP-Link Archer Router Unauthenticated Access Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2019-46266

DESCRIPTION

TP-Link Archer is a wireless router of China TP-Link company. The TP-Link Archer router has an unauthenticated access vulnerability. An attacker can use this vulnerability to reset the administrator password by constructing a malicious attack script.

Trust: 0.6

sources: CNVD: CNVD-2019-46266

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-46266

AFFECTED PRODUCTS

vendor:tp linkmodel:archer c5scope:eqversion:v4<190815

Trust: 0.6

vendor:tp linkmodel:archer mr200scope:eqversion:v4<190730

Trust: 0.6

vendor:tp linkmodel:archer mr400scope:eqversion:v3<190730

Trust: 0.6

vendor:tp linkmodel:archer mr6400scope:eqversion:v4<190730

Trust: 0.6

sources: CNVD: CNVD-2019-46266

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2019-46266
value: HIGH

Trust: 0.6

CNVD: CNVD-2019-46266
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2019-46266

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201912-1679

PATCH

title:Patch for TP-Link Archer Router Unauthenticated Access Vulnerabilityurl:https://www.cnvd.org.cn/patchinfo/show/194761

Trust: 0.6

title:Multiple TP-Link Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=107146

Trust: 0.6

sources: CNVD: CNVD-2019-46266 // CNNVD: CNNVD-201912-1679

EXTERNAL IDS

db:NVDid:CVE-2019-7405

Trust: 1.2

db:CNVDid:CNVD-2019-46266

Trust: 0.6

db:CNNVDid:CNNVD-201912-1679

Trust: 0.6

sources: CNVD: CNVD-2019-46266 // CNNVD: CNNVD-201912-1679

REFERENCES

url:https://securityintelligence.com/posts/tp-link-archer-router-vulnerability-voids-admin-password-can-allow-remote-takeover/

Trust: 1.2

url:https://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=31965

Trust: 0.6

url:https://www.bleepingcomputer.com/news/security/tp-link-router-bug-lets-attackers-login-without-passwords/

Trust: 0.6

url:https://fortiguard.com/encyclopedia/ips/48629/tp-link-archer-c5-admin-password-reset

Trust: 0.6

sources: CNVD: CNVD-2019-46266 // CNNVD: CNNVD-201912-1679

CREDITS

IBM X-Force Red’s Grzegorz Wypych (aka @horac341)

Trust: 0.6

sources: CNNVD: CNNVD-201912-1679

SOURCES

db:CNVDid:CNVD-2019-46266
db:CNNVDid:CNNVD-201912-1679

LAST UPDATE DATE

2022-05-04T08:35:02.659000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2019-46266date:2019-12-20T00:00:00
db:CNNVDid:CNNVD-201912-1679date:2020-03-20T00:00:00

SOURCES RELEASE DATE

db:CNVDid:CNVD-2019-46266date:2019-12-20T00:00:00
db:CNNVDid:CNNVD-201912-1679date:2019-12-16T00:00:00