Details of VAR-202001-0808

ID

VAR-202001-0808

CVE

CVE-2019-19143

TITLE

TP-LINK TL-WR849N Authentication vulnerabilities in devices

Trust: 0.8

sources: JVNDB: JVNDB-2019-014383

DESCRIPTION

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI. TP-LINK TL-WR849N The device contains an authentication vulnerability.The information may be obtained and the information may be altered. TP-LINK TL-WR849N is a 300mbps WiFi router. TP-LINK TL-WR849N version 0.9.1 4.16 has an authorization issue vulnerability. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a network system or product. No detailed vulnerability details are provided at this time

Trust: 2.16

sources: NVD: CVE-2019-19143 // JVNDB: JVNDB-2019-014383 // CNVD: CNVD-2020-15948

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-15948

AFFECTED PRODUCTS

vendor:	tp link	model:	tl-wr849n	scope:	eq	version:	0.9.1_4.16	Trust: 1.0
vendor:	tp link	model:	tl-wr849n	scope:	eq	version:	-	Trust: 0.8
vendor:	tp link	model:	tl-wr849n	scope:	eq	version:	tl-wr849n firmware 0.9.1 4.16	Trust: 0.8
vendor:	tp link	model:	tl-wr849n	scope:	eq	version:	0.9.14.16	Trust: 0.6

sources: CNVD: CNVD-2020-15948 // JVNDB: JVNDB-2019-014383 // NVD: CVE-2019-19143

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-19143
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-19143
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2020-15948
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202001-1188
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2019-19143
severity:	MEDIUM
baseScore:	4.1
vectorString:	AV:A/AC:L/AU:S/C:P/I:P/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	5.1
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2020-15948
severity:	MEDIUM
baseScore:	6.7
vectorString:	AV:A/AC:L/AU:M/C:C/I:C/A:N
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	MULTIPLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	NONE
exploitabilityScore:	4.1
impactScore:	9.2
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2019-19143
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	0.9
impactScore:	5.2
version:	3.1
Trust: 1.0
NVD:	CVE-2019-19143
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-15948 // JVNDB: JVNDB-2019-014383 // CNNVD: CNNVD-202001-1188 // NVD: CVE-2019-19143

PROBLEMTYPE DATA

problemtype:	CWE-306	Trust: 1.0
problemtype:	Incorrect authentication (CWE-287) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2019-014383 // NVD: CVE-2019-19143

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202001-1188

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202001-1188

PATCH

title:

TL-WR849N

url:

https://www.tp-link.com/br/home-networking/wifi-router/tl-wr849n/

Trust: 0.8

sources: JVNDB: JVNDB-2019-014383

EXTERNAL IDS

db:	NVD	id:	CVE-2019-19143	Trust: 3.0
db:	PACKETSTORM	id:	156586	Trust: 2.2
db:	JVNDB	id:	JVNDB-2019-014383	Trust: 0.8
db:	CNVD	id:	CNVD-2020-15948	Trust: 0.6
db:	EXPLOIT-DB	id:	48152	Trust: 0.6
db:	CNNVD	id:	CNNVD-202001-1188	Trust: 0.6

sources: CNVD: CNVD-2020-15948 // JVNDB: JVNDB-2019-014383 // CNNVD: CNNVD-202001-1188 // NVD: CVE-2019-19143

REFERENCES

url:	https://fireshellsecurity.team/hack-n-routers/	Trust: 2.4
url:	http://packetstormsecurity.com/files/156586/tp-link-tl-wr849n-0.9.1-4.16-authentication-bypass.html	Trust: 2.2
url:	https://nvd.nist.gov/vuln/detail/cve-2019-19143	Trust: 1.4
url:	https://www.exploit-db.com/exploits/48152	Trust: 0.6

sources: CNVD: CNVD-2020-15948 // JVNDB: JVNDB-2019-014383 // CNNVD: CNNVD-202001-1188 // NVD: CVE-2019-19143

CREDITS

Elber Tavares

Trust: 0.6

sources: CNNVD: CNNVD-202001-1188

SOURCES

db:	CNVD	id:	CNVD-2020-15948
db:	JVNDB	id:	JVNDB-2019-014383
db:	CNNVD	id:	CNNVD-202001-1188
db:	NVD	id:	CVE-2019-19143

LAST UPDATE DATE

2024-11-23T22:51:31.321000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-15948	date:	2020-03-07T00:00:00
db:	JVNDB	id:	JVNDB-2019-014383	date:	2020-02-13T00:00:00
db:	CNNVD	id:	CNNVD-202001-1188	date:	2021-01-05T00:00:00
db:	NVD	id:	CVE-2019-19143	date:	2024-11-21T04:34:15.580

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-15948	date:	2020-03-07T00:00:00
db:	JVNDB	id:	JVNDB-2019-014383	date:	2020-02-13T00:00:00
db:	CNNVD	id:	CNNVD-202001-1188	date:	2020-01-27T00:00:00
db:	NVD	id:	CVE-2019-19143	date:	2020-01-27T19:15:11.097