Sign-up

ID

VAR-202202-0899


CVE

CVE-2022-0650


TITLE

TP-LINK Technologies  of  TL-WR940N  Out-of-bounds write vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2022-022090

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13993. TP-LINK Technologies of TL-WR940N An out-of-bounds write vulnerability exists in firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 2.34

sources: NVD: CVE-2022-0650 // JVNDB: JVNDB-2022-022090 // ZDI: ZDI-22-407 // VULMON: CVE-2022-0650

AFFECTED PRODUCTS

vendor:tp linkmodel:tl-wr940nscope: - version: -

Trust: 1.5

vendor:tp linkmodel:tl-wr940nscope:ltversion:211111

Trust: 1.0

vendor:tp linkmodel:tl-wr940nscope:eqversion:tl-wr940n firmware 211111

Trust: 0.8

vendor:tp linkmodel:tl-wr940nscope:eqversion: -

Trust: 0.8

sources: ZDI: ZDI-22-407 // JVNDB: JVNDB-2022-022090 // NVD: CVE-2022-0650

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com: CVE-2022-0650
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2022-0650
value: HIGH

Trust: 1.0

NVD: CVE-2022-0650
value: HIGH

Trust: 0.8

ZDI: CVE-2022-0650
value: MEDIUM

Trust: 0.7

CNNVD: CNNVD-202202-1735
value: HIGH

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2022-0650
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-0650
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.1
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-0650
baseSeverity: HIGH
baseScore: 8.0
vectorString: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-0650
baseSeverity: MEDIUM
baseScore: 6.8
vectorString: AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-407 // JVNDB: JVNDB-2022-022090 // CNNVD: CNNVD-202202-1735 // NVD: CVE-2022-0650 // NVD: CVE-2022-0650

PROBLEMTYPE DATA

problemtype:CWE-121

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-022090 // NVD: CVE-2022-0650

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202202-1735

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202202-1735

EXTERNAL IDS

db:NVDid:CVE-2022-0650

Trust: 4.0

db:ZDIid:ZDI-22-407

Trust: 3.2

db:JVNDBid:JVNDB-2022-022090

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-13993

Trust: 0.7

db:CNNVDid:CNNVD-202202-1735

Trust: 0.6

db:VULMONid:CVE-2022-0650

Trust: 0.1

sources: ZDI: ZDI-22-407 // VULMON: CVE-2022-0650 // JVNDB: JVNDB-2022-022090 // CNNVD: CNNVD-202202-1735 // NVD: CVE-2022-0650

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-22-407/

Trust: 3.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-0650

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-0650/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/121.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2022-0650 // JVNDB: JVNDB-2022-022090 // CNNVD: CNNVD-202202-1735 // NVD: CVE-2022-0650

CREDITS

Vadym Kolisnichenko

Trust: 1.3

sources: ZDI: ZDI-22-407 // CNNVD: CNNVD-202202-1735

SOURCES

db:ZDIid:ZDI-22-407
db:VULMONid:CVE-2022-0650
db:JVNDBid:JVNDB-2022-022090
db:CNNVDid:CNNVD-202202-1735
db:NVDid:CVE-2022-0650

LAST UPDATE DATE

2024-08-14T14:31:21.458000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-407date:2022-02-22T00:00:00
db:VULMONid:CVE-2022-0650date:2023-03-28T00:00:00
db:JVNDBid:JVNDB-2022-022090date:2023-11-15T04:47:00
db:CNNVDid:CNNVD-202202-1735date:2023-04-07T00:00:00
db:NVDid:CVE-2022-0650date:2023-04-06T19:16:25.113

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-407date:2022-02-22T00:00:00
db:VULMONid:CVE-2022-0650date:2023-03-28T00:00:00
db:JVNDBid:JVNDB-2022-022090date:2023-11-15T00:00:00
db:CNNVDid:CNNVD-202202-1735date:2022-02-22T00:00:00
db:NVDid:CVE-2022-0650date:2023-03-28T19:15:09.987