9.8

CVE-2020-12110

Exploit

Certain TP-Link devices have a Hardcoded Encryption Key. This affects NC200 2.1.9 build 200225, N210 1.0.9 build 200304, NC220 1.3.0 build 200304, NC230 1.3.0 build 200304, NC250 1.3.0 build 200304, NC260 1.5.2 build 200304, and NC450 1.5.3 build 200304.

Data is provided by the National Vulnerability Database (NVD)
Tp-link ≫ Nc200 Firmware Version2.1.6 Update160108_b
   Tp-link ≫ Nc200 Version-
Tp-link ≫ Nc200 Firmware Version2.1.9 Update200225
   Tp-link ≫ Nc200 Version-
Tp-link ≫ Nc210 Firmware Version1.0.3 Update160229
   Tp-link ≫ Nc210 Version-
Tp-link ≫ Nc210 Firmware Version1.0.4 Update160412
   Tp-link ≫ Nc210 Version-
Tp-link ≫ Nc210 Firmware Version1.0.9 Update200304
   Tp-link ≫ Nc210 Version-
Tp-link ≫ Nc220 Firmware Version1.2.0 Update170516
   Tp-link ≫ Nc220 Version-
Tp-link ≫ Nc220 Firmware Version1.3.0 Update180105
   Tp-link ≫ Nc220 Version-
Tp-link ≫ Nc220 Firmware Version1.3.0 Update200304
   Tp-link ≫ Nc220 Version-
Tp-link ≫ Nc230 Firmware Version1.0.3 Update160108
   Tp-link ≫ Nc230 Version-
Tp-link ≫ Nc230 Firmware Version1.2.1 Update170515
   Tp-link ≫ Nc230 Version-
Tp-link ≫ Nc230 Firmware Version1.3.0 Update200304
   Tp-link ≫ Nc230 Version-
Tp-link ≫ Nc250 Firmware Version1.0.8 Update160108
   Tp-link ≫ Nc250 Version-
Tp-link ≫ Nc250 Firmware Version1.0.10 Update160321
   Tp-link ≫ Nc250 Version-
Tp-link ≫ Nc250 Firmware Version1.2.1 Update170515
   Tp-link ≫ Nc250 Version-
Tp-link ≫ Nc250 Firmware Version1.3.0 Update200304
   Tp-link ≫ Nc250 Version-
Tp-link ≫ Nc260 Firmware Version1.0.5 Update160804
   Tp-link ≫ Nc260 Version-
Tp-link ≫ Nc260 Firmware Version1.0.6 Update161114
   Tp-link ≫ Nc260 Version-
Tp-link ≫ Nc260 Firmware Version1.4.1 Update180720
   Tp-link ≫ Nc260 Version-
Tp-link ≫ Nc260 Firmware Version1.5.0 Update181123
   Tp-link ≫ Nc260 Version-
Tp-link ≫ Nc260 Firmware Version1.5.2 Update200304
   Tp-link ≫ Nc260 Version-
Tp-link ≫ Nc450 Firmware Version1.0.15 Update160920
   Tp-link ≫ Nc450 Version-
Tp-link ≫ Nc450 Firmware Version1.1.2 Update161013
   Tp-link ≫ Nc450 Version-
Tp-link ≫ Nc450 Firmware Version1.3.4 Update171130
   Tp-link ≫ Nc450 Version-
Tp-link ≫ Nc450 Firmware Version1.5.3 Update200304
   Tp-link ≫ Nc450 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.08% 0.758
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://seclists.org/fulldisclosure/2020/May/3
Third Party Advisory
Exploit
Mailing List