Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

CVSS 3.1 · 6.5 Medium EPSS 20.0% KEV · Listed
Vendors
Tp-link
Products
Archer C1900 Archer C1900 Firmware Archer C5 and 69 more
CVE-2015-3035

Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before 150304, and C8 (1.0) with firmware before 150316, Archer C9 (1.0), TL-WDR3500 (1.0), TL-WDR3600 (1.0), and TL-WDR4300 (1.0) with firmware before 150302, TL-WR740N (5.0) and TL-WR741ND (5.0) with firmware before 150312, and TL-WR841N (9.0), TL-WR841N (10.0), TL-WR841ND (9.0), and TL-WR841ND (10.0) with firmware before 150310 allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/.

CVSS 3.1 · 7.5 High EPSS 83.9% KEV · Listed
Vendors
Tp-link
Products
Archer C5 Archer C5 Firmware Archer C7 and 19 more
CVE-2014-4728

The web server in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to cause a denial of service (crash) via a long header in a GET request.

CVSS 2.0 · 5.0 Medium EPSS 1.8% KEV · Not listed
Vendors
Tp-link
Products
Tl-wdr4300 Tl-wdr4300 Firmware
CVE-2014-4727

Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed
Vendors
Tp-link
Products
Tl-wdr4300 Tl-wdr4300 Firmware
CVE-2019-6487

TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution, because shell metacharacters can be included in the weather get_weather_observe citycode field.

CVSS 3.0 · 8.8 High EPSS 8.5% KEV · Not listed
Vendors
Tp-link
Products
Tl-wdr3500 Tl-wdr3500 Firmware Tl-wdr3600 and 7 more