6.1

CVE-2021-3275

Exploit
Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Td-w9977 Firmware Version v1_0.1.0_0.9.1_up_boot(161123)_2016-11-23_15.36.15
   Tp-link ≫ Td-w9977 Version -
Tp-link ≫ Tl-wa801nd Firmware Version v5_us_0.9.1_3.16_up_boot[170905-rel56404]
   Tp-link ≫ Tl-wa801nd Version -
Tp-link ≫ Tl-wa801n Firmware Version v6_eu_0.9.1_3.16_up_boot[200116-rel61815]
   Tp-link ≫ Tl-wa801n Version -
Tp-link ≫ Tl-wr802n Firmware Version v4_us_0.9.1_3.17_up_boot[200421-rel38950]
   Tp-link ≫ Tl-wr802n Version -
Tp-link ≫ Archer-c3150 Firmware Version v2_170926
   Tp-link ≫ Archer-c3150 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.79% 0.755
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://www.tp-link.com
Vendor Advisory
http://packetstormsecurity.com/files/161989/TP-Link-Cross-Site-Scripting.html
Third Party Advisory
Exploit
VDB Entry
https://github.com/smriti548/CVE/blob/main/CVE-2021-3275
Third Party Advisory
Exploit
https://seclists.org/fulldisclosure/2021/Mar/67
Third Party Advisory
Exploit
Mailing List