CVE-2021-31659

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery CSRF. All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the passwo...

CVE-2021-31658

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application t...

CVE-2021-31659

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery CSRF. All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the passwo...

Cross site request forgery (csrf)

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery CSRF. All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the passwo...

Design/Logic Flaw

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application t...

CVE-2021-31659

CVE-2021-31659 affects TP-Link TL-SG2005 and TL-SG2008 (1.0.0 Build 20180529 Rel.40524). The root cause is a CSRF vulnerability where sensitive configuration is in the URL and no token authentication is required, enabling a crafted link to modify the switch password and tamper configuration. Expl...

CVE-2021-31658

The CVE-2021-31658 entry concerns TP-Link TL-SG2005 and TL-SG2008 (version 1.0.0 Build 20180529 Rel.40524). The vulnerability is an array index error in the interface that provides the Device Description, which only checks data length and does not filter special characters. This can cause the app...