Sign-up

ID

VAR-202106-1458


CVE

CVE-2021-28857


TITLE

TP-Link TL-WPA4220  Vulnerability regarding inadequate protection of credentials in

Trust: 0.8

sources: JVNDB: JVNDB-2021-008413

DESCRIPTION

TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064 username and password are sent via the cookie. TP-Link TL-WPA4220 Exists in an inadequate protection of credentials.Information may be obtained. Tp-link TP-Link TL-WPA4220 is a domestic wireless WiFi bridge that can extend wireless signal from China's Tp-link company. The device can transmit data at high speed through the line, and expand the network to areas that cannot be covered at present. TP-Link TL-WPA4220 has an information disclosure vulnerability, which originates from TP-Link's TL-WPA4220 4.0.2 Build 20180308 Rel.37064. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2021-28857 // JVNDB: JVNDB-2021-008413 // CNVD: CNVD-2021-43409

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-43409

AFFECTED PRODUCTS

vendor:tp linkmodel:tl-wpa4220scope:eqversion:4.0.2

Trust: 1.0

vendor:tp linkmodel:tl-wpa4220scope:eqversion: -

Trust: 0.8

vendor:tp linkmodel:tl-wpa4220scope:eqversion:tl-wpa4220 firmware 4.0.2 build 20180308 rel.37064

Trust: 0.8

vendor:tp linkmodel:tl-wpa4220scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2021-43409 // JVNDB: JVNDB-2021-008413 // NVD: CVE-2021-28857

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-28857
value: HIGH

Trust: 1.0

NVD: CVE-2021-28857
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-43409
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202106-1284
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2021-28857
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2021-43409
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-28857
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-28857
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-43409 // JVNDB: JVNDB-2021-008413 // CNNVD: CNNVD-202106-1284 // NVD: CVE-2021-28857

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.0

problemtype:Inadequate protection of credentials (CWE-522) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-008413 // NVD: CVE-2021-28857

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202106-1284

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202106-1284

PATCH

title:top pageurl:https://www.tp-link.com/jp/

Trust: 0.8

sources: JVNDB: JVNDB-2021-008413

EXTERNAL IDS

db:NVDid:CVE-2021-28857

Trust: 3.8

db:JVNDBid:JVNDB-2021-008413

Trust: 0.8

db:CNVDid:CNVD-2021-43409

Trust: 0.6

db:CNNVDid:CNNVD-202106-1284

Trust: 0.6

sources: CNVD: CNVD-2021-43409 // JVNDB: JVNDB-2021-008413 // CNNVD: CNNVD-202106-1284 // NVD: CVE-2021-28857

REFERENCES

url:https://yunus-shn.medium.com/tp-links-tl-wpa4220-v4-0-cleartext-credentials-in-cookie-7516a2649394

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2021-28857

Trust: 1.4

sources: CNVD: CNVD-2021-43409 // JVNDB: JVNDB-2021-008413 // CNNVD: CNNVD-202106-1284 // NVD: CVE-2021-28857

SOURCES

db:CNVDid:CNVD-2021-43409
db:JVNDBid:JVNDB-2021-008413
db:CNNVDid:CNNVD-202106-1284
db:NVDid:CVE-2021-28857

LAST UPDATE DATE

2024-08-14T13:23:30.991000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-43409date:2021-06-19T00:00:00
db:JVNDBid:JVNDB-2021-008413date:2022-03-15T02:34:00
db:CNNVDid:CNNVD-202106-1284date:2021-08-16T00:00:00
db:NVDid:CVE-2021-28857date:2021-06-23T19:47:37.117

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-43409date:2021-06-19T00:00:00
db:JVNDBid:JVNDB-2021-008413date:2022-03-15T00:00:00
db:CNNVDid:CNNVD-202106-1284date:2021-06-15T00:00:00
db:NVDid:CVE-2021-28857date:2021-06-15T22:15:08.757