9.8

CVE-2017-8074

Exploit

On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.

Data is provided by the National Vulnerability Database (NVD)
Tp-link ≫ Tl-sg108e Firmware Version1.1.2
   Tp-link ≫ Tl-sg108e Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.35% 0.783
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

http://www.securityfocus.com/bid/97981
Third Party Advisory
VDB Entry
https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/
Third Party Advisory
Exploit
Technical Description