TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 Privilege Escalation
🗓️ 04 Mar 2024 00:00:00Reported by Shahnawaz ShaikhType 
packetstorm🔗 packetstormsecurity.com👁 338 Views
| Reporter | Title | Published | Views | Family All 14 |
|---|---|---|---|---|
 | TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 Privilege Escalation Vulnerability | 5 Mar 202400:00 | – | zdt |
 | TP-Link JetStream TL-SG2210P Path Traversal Privilege Escalation | 18 Mar 202400:00 | – | bdu_fstec |
 | CVE-2023-43318 | 3 Mar 202403:06 | – | circl |
 | TP-LINK JetStream Smart Switch TL-SG2210P Security Breach | 5 Mar 202400:00 | – | cnnvd |
 | CVE-2023-43318 | 5 Mar 202400:00 | – | cve |
 | CVE-2023-43318 | 5 Mar 202400:00 | – | cvelist |
 | CVE-2023-43318 | 19 Oct 202610:38 | – | kitploit |
 | CVE-2023-43318 | 6 Mar 202400:15 | – | nvd |
 | CVE-2023-43318 | 6 Mar 202400:15 | – | osv_cve |
 | Design/Logic Flaw | 6 Mar 202400:15 | – | prion |
10
`[+] Credits: Shahnawaz Shaikh, Security Researcher at Cybergate Defense LLC
[+] twitter.com/_striv3r_
[Vendor]
Tp-Link (http://tp-link.com)
[Product]
JetStream Smart Switch - TL-SG2210P v5.0 Build 20211201
[Vulnerability Type]
Improper Access Control
[Affected Product Code Base]
JetStream Smart Switch - TL-SG2210P v5.0 Build 20211201
[Affected Component]
usermanagement, swtmactablecfg endpoints of webconsole
[CVE Reference]
CVE-2023-43318
[Security Issue]
TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows
attackers to escalate privileges via modification of the 'tid' and 'usrlvl'
values in GET requests.
[Exploit/POC]
N/A
[Network Access]
Remote
[Severity]
High
[Disclosure Timeline]
Vendor Notification: September 12, 2023
Vendor released fixed firmware TL-SG2210P(UN)_V5.20_5.20.1 Build 20240202:
February 29, 2024
March 1, 2024 : Public Disclosure
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Mar 2024 00:00Current
7.4High risk
Vulners AI Score7.4
EPSS0.01137