6.1

CVE-2021-3275

Exploit

Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Td-w9977 Firmware Versionv1_0.1.0_0.9.1_up_boot(161123)_2016-11-23_15.36.15
   Tp-link ≫ Td-w9977 Version-
Tp-link ≫ Tl-wa801nd Firmware Versionv5_us_0.9.1_3.16_up_boot[170905-rel56404]
   Tp-link ≫ Tl-wa801nd Version-
Tp-link ≫ Tl-wa801n Firmware Versionv6_eu_0.9.1_3.16_up_boot[200116-rel61815]
   Tp-link ≫ Tl-wa801n Version-
Tp-link ≫ Tl-wr802n Firmware Versionv4_us_0.9.1_3.17_up_boot[200421-rel38950]
   Tp-link ≫ Tl-wr802n Version-
Tp-link ≫ Archer-c3150 Firmware Versionv2_170926
   Tp-link ≫ Archer-c3150 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.22% 0.773
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.tp-link.com
Vendor Advisory
https://seclists.org/fulldisclosure/2021/Mar/67
Third Party Advisory
Exploit
Mailing List