Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | HB810(US2) V1.0/1.6/2.0/2.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB810(EU1) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB710(US2) V1.6/1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB710(EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB610(US2) V2.6/2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB610(EU1) | unaffected |
|
||||||
| TP-Link Systems Inc. | HB610(CA) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB410( EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210(US2) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210(EU1) 1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210 Pro(EU1)1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HB210 Pro(US2)1.0/1.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX510(US1) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX510(EU1) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX510(CA) V1.0/2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX510(AU) V1.0/2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX510(US2) 2.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX710(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX710 Pro(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX220(US1) V1.0/1.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX220(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX220(CA) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX220(AU) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HX141(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HC220-G5(US1) V1.0/1.6 | unaffected |
|
||||||
| TP-Link Systems Inc. | HC220-G5(EU1) V1.20/1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | HC220-G5(BR) V1.30 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX141(BR) V1.0/1.9 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX141(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX141(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(BR) V1.0/1.20/1.28/1.29/1.8 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(BR) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(EU1) V1.0/1.20 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(RU) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX220(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX222(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX222(KR) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX222(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX511(BR) V2.0/2.8/2.9 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX511(EU1) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX511(US1) V2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX520(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX520v(EU1)1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX521(US1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX820v(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | EX920(US2) V1.6/V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | XC220-G3v(EU1) V2.30 | unaffected |
|
||||||
| TP-Link Systems Inc. | XC220-G3v(US1) V2.30 | unaffected |
|
||||||
| TP-Link Systems Inc. | XX530v(BR)v1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | XX530v(BR)v2.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | XX530v(US1) | unaffected |
|
||||||
| TP-Link Systems Inc. | XX530v(EU1) | unaffected |
|
||||||
| TP-Link Systems Inc. | XX230v(BR) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | VX800v(DE) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | VX1800v(EU1) V1.0 | unaffected |
|
||||||
| TP-Link Systems Inc. | VX420-G2h(AU) V3.0 | unaffected |
|
No data.
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Tp-link | Aginet |
|
||||||||
| Tp-link | Ex141(br) V1.0/1.9 |
|
||||||||
| Tp-link | Ex141(eu1) V1.0 |
|
||||||||
| Tp-link | Ex141(us1) V1.0 |
|
||||||||
| Tp-link | Ex220(br) V1.0/1.20/1.28/1.29/1.8 |
|
||||||||
| Tp-link | Ex220(br) V2.0 |
|
||||||||
| Tp-link | Ex220(eu1) V1.0/1.20 |
|
||||||||
| Tp-link | Ex220(ru) V1.0 |
|
||||||||
| Tp-link | Ex220(us1) V1.0 |
|
||||||||
| Tp-link | Ex222(eu1) V1.0 |
|
||||||||
| Tp-link | Ex222(kr) V1.0 |
|
||||||||
| Tp-link | Ex222(us1) V1.0 |
|
||||||||
| Tp-link | Ex511(br) V2.0/2.8/2.9 |
|
||||||||
| Tp-link | Ex511(eu1) V2.0 |
|
||||||||
| Tp-link | Ex511(us1) V2.0 |
|
||||||||
| Tp-link | Ex520(us1) V1.0 |
|
||||||||
| Tp-link | Ex520v(eu1)1.0 |
|
||||||||
| Tp-link | Ex521(us1) V1.0 |
|
||||||||
| Tp-link | Ex820v(eu1) V1.0 |
|
||||||||
| Tp-link | Ex920(us2) V1.6/v1.0 |
|
||||||||
| Tp-link | Hb210(eu1) 1.0 |
|
||||||||
| Tp-link | Hb210(us2) 1.0 |
|
||||||||
| Tp-link | Hb210 Pro(eu1)1.0 |
|
||||||||
| Tp-link | Hb210 Pro(us2)1.0/1.6 |
|
||||||||
| Tp-link | Hb410( Eu1) 1.0 |
|
||||||||
| Tp-link | Hb610(ca) V2.0 |
|
||||||||
| Tp-link | Hb610(eu1) |
|
||||||||
| Tp-link | Hb610(us2) V2.6/2.0 |
|
||||||||
| Tp-link | Hb710(eu1) 1.0 |
|
||||||||
| Tp-link | Hb710(us2) V1.6/1.0 |
|
||||||||
| Tp-link | Hb810(eu1) V2.0 |
|
||||||||
| Tp-link | Hb810(us2) V1.0/1.6/2.0/2.6 |
|
||||||||
| Tp-link | Hc220-g5(br) V1.30 |
|
||||||||
| Tp-link | Hc220-g5(eu1) V1.20/1.0 |
|
||||||||
| Tp-link | Hc220-g5(us1) V1.0/1.6 |
|
||||||||
| Tp-link | Hx141(eu1) V1.0 |
|
||||||||
| Tp-link | Hx220(au) V1.0 |
|
||||||||
| Tp-link | Hx220(ca) V1.0 |
|
||||||||
| Tp-link | Hx220(eu1) V1.0 |
|
||||||||
| Tp-link | Hx220(us1) V1.0/1.0 |
|
||||||||
| Tp-link | Hx510(au) V1.0/2.0 |
|
||||||||
| Tp-link | Hx510(ca) V1.0/2.0 |
|
||||||||
| Tp-link | Hx510(eu1) V2.0 |
|
||||||||
| Tp-link | Hx510(us1) V2.0 |
|
||||||||
| Tp-link | Hx510(us2) 2.6 |
|
||||||||
| Tp-link | Hx710(eu1) V1.0 |
|
||||||||
| Tp-link | Hx710 Pro(eu1) V1.0 |
|
||||||||
| Tp-link | Vx1800v(eu1) V1.0 |
|
||||||||
| Tp-link | Vx420-g2h(au) V3.0 |
|
||||||||
| Tp-link | Vx800v(de) V1.0 |
|
||||||||
| Tp-link | Xc220-g3v(eu1) V2.30 |
|
||||||||
| Tp-link | Xc220-g3v(us1) V2.30 |
|
||||||||
| Tp-link | Xx230v(br) V1.0 |
|
||||||||
| Tp-link | Xx530v(br)v1.0 |
|
||||||||
| Tp-link | Xx530v(br)v2.0 |
|
||||||||
| Tp-link | Xx530v(eu1) |
|
||||||||
| Tp-link | Xx530v(us1) |
|
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.331% probability within 30 days)
| Link | Providers |
|---|---|
| https://www.tp-link.com/us/support/faq/5239/ |
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Tp-link
Tp-link aginet Tp-link ex141(br) V1.0/1.9 Tp-link ex141(eu1) V1.0 Tp-link ex141(us1) V1.0 Tp-link ex220(br) V1.0/1.20/1.28/1.29/1.8 Tp-link ex220(br) V2.0 Tp-link ex220(eu1) V1.0/1.20 Tp-link ex220(ru) V1.0 Tp-link ex220(us1) V1.0 Tp-link ex222(eu1) V1.0 Tp-link ex222(kr) V1.0 Tp-link ex222(us1) V1.0 Tp-link ex511(br) V2.0/2.8/2.9 Tp-link ex511(eu1) V2.0 Tp-link ex511(us1) V2.0 Tp-link ex520(us1) V1.0 Tp-link ex520v(eu1)1.0 Tp-link ex521(us1) V1.0 Tp-link ex820v(eu1) V1.0 Tp-link ex920(us2) V1.6/v1.0 Tp-link hb210(eu1) 1.0 Tp-link hb210(us2) 1.0 Tp-link hb210 Pro(eu1)1.0 Tp-link hb210 Pro(us2)1.0/1.6 Tp-link hb410( Eu1) 1.0 Tp-link hb610(ca) V2.0 Tp-link hb610(eu1) Tp-link hb610(us2) V2.6/2.0 Tp-link hb710(eu1) 1.0 Tp-link hb710(us2) V1.6/1.0 Tp-link hb810(eu1) V2.0 Tp-link hb810(us2) V1.0/1.6/2.0/2.6 Tp-link hc220-g5(br) V1.30 Tp-link hc220-g5(eu1) V1.20/1.0 Tp-link hc220-g5(us1) V1.0/1.6 Tp-link hx141(eu1) V1.0 Tp-link hx220(au) V1.0 Tp-link hx220(ca) V1.0 Tp-link hx220(eu1) V1.0 Tp-link hx220(us1) V1.0/1.0 Tp-link hx510(au) V1.0/2.0 Tp-link hx510(ca) V1.0/2.0 Tp-link hx510(eu1) V2.0 Tp-link hx510(us1) V2.0 Tp-link hx510(us2) 2.6 Tp-link hx710(eu1) V1.0 Tp-link hx710 Pro(eu1) V1.0 Tp-link vx1800v(eu1) V1.0 Tp-link vx420-g2h(au) V3.0 Tp-link vx800v(de) V1.0 Tp-link xc220-g3v(eu1) V2.30 Tp-link xc220-g3v(us1) V2.30 Tp-link xx230v(br) V1.0 Tp-link xx530v(br)v1.0 Tp-link xx530v(br)v2.0 Tp-link xx530v(eu1) Tp-link xx530v(us1) |
|
| Vendors & Products |
Tp-link
Tp-link aginet Tp-link ex141(br) V1.0/1.9 Tp-link ex141(eu1) V1.0 Tp-link ex141(us1) V1.0 Tp-link ex220(br) V1.0/1.20/1.28/1.29/1.8 Tp-link ex220(br) V2.0 Tp-link ex220(eu1) V1.0/1.20 Tp-link ex220(ru) V1.0 Tp-link ex220(us1) V1.0 Tp-link ex222(eu1) V1.0 Tp-link ex222(kr) V1.0 Tp-link ex222(us1) V1.0 Tp-link ex511(br) V2.0/2.8/2.9 Tp-link ex511(eu1) V2.0 Tp-link ex511(us1) V2.0 Tp-link ex520(us1) V1.0 Tp-link ex520v(eu1)1.0 Tp-link ex521(us1) V1.0 Tp-link ex820v(eu1) V1.0 Tp-link ex920(us2) V1.6/v1.0 Tp-link hb210(eu1) 1.0 Tp-link hb210(us2) 1.0 Tp-link hb210 Pro(eu1)1.0 Tp-link hb210 Pro(us2)1.0/1.6 Tp-link hb410( Eu1) 1.0 Tp-link hb610(ca) V2.0 Tp-link hb610(eu1) Tp-link hb610(us2) V2.6/2.0 Tp-link hb710(eu1) 1.0 Tp-link hb710(us2) V1.6/1.0 Tp-link hb810(eu1) V2.0 Tp-link hb810(us2) V1.0/1.6/2.0/2.6 Tp-link hc220-g5(br) V1.30 Tp-link hc220-g5(eu1) V1.20/1.0 Tp-link hc220-g5(us1) V1.0/1.6 Tp-link hx141(eu1) V1.0 Tp-link hx220(au) V1.0 Tp-link hx220(ca) V1.0 Tp-link hx220(eu1) V1.0 Tp-link hx220(us1) V1.0/1.0 Tp-link hx510(au) V1.0/2.0 Tp-link hx510(ca) V1.0/2.0 Tp-link hx510(eu1) V2.0 Tp-link hx510(us1) V2.0 Tp-link hx510(us2) 2.6 Tp-link hx710(eu1) V1.0 Tp-link hx710 Pro(eu1) V1.0 Tp-link vx1800v(eu1) V1.0 Tp-link vx420-g2h(au) V3.0 Tp-link vx800v(de) V1.0 Tp-link xc220-g3v(eu1) V2.30 Tp-link xc220-g3v(us1) V2.30 Tp-link xx230v(br) V1.0 Tp-link xx530v(br)v1.0 Tp-link xx530v(br)v2.0 Tp-link xx530v(eu1) Tp-link xx530v(us1) |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device. | |
| Title | Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV4_0
|