DD-WRT 45723 - UPNP Buffer Overflow Exploit

Exploit Title: DD-WRT 45723 - UPNP Buffer Overflow PoC Exploit Author: Selim Enes 'Enesdex' Karaduman Vendor Homepage: https://dd-wrt.com/ Software Link: https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2021/ Version: 45723 or prior Tested on: TP-Link Archer C7...

CVE-2021-27245

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7USV5210125 and Archer A7USV5200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue...

CVE-2021-27245

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7USV5210125 and Archer A7USV5200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue...

CVE-2021-27245

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7USV5210125 and Archer A7USV5200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue...

Authentication flaw

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7USV5210125 and Archer A7USV5200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue...

CVE-2021-27245

CVE-2021-27245 affects TP-Link Archer A7 family (A7 AC1750; Archer C7 US variants) prior to the specified V5 firmwares. Root cause: improper filtering of IPv6 SSH connections during IPv6 handling enables a firewall bypass by unauthenticated attackers, who could leverage this in conjunction with o...

CVE-2021-27245

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7USV5210125 and Archer A7USV5200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue...

TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting (Unauthenticated)

Exploit Title: TP-Link Devices - 'setDefaultHostname' Stored Cross-site Scripting Unauthenticated Date: 24-07-2020 Exploit Author: Smriti Gaba, Kaustubh Padwad Vendor Homepage: https://www.tp-link.com Version: Multiple ============================================================== Unauthenticated...

CVE-2021-3275

Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...

CVE-2021-3275

Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...

Cross site scripting

Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...

CVE-2021-3275

Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...

CVE-2021-3275

Unauthenticated stored cross-site scripting XSS exists in multiple TP-Link products including WIFI Routers Wireless AC routers, Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper...

CVE-2021-3275

CVE-2021-3275 describes an unauthenticated stored cross-site scripting (XSS) affecting multiple TP-Link devices (TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, Archer C3150v2). Root cause is improper sanitization in hostname handling via the vulnerable function setDefaultHostname(), with exp...

TP-Link Cross Site Scripting

============================================================== Unauthenticated Stored Cross-site Scripting in Multiple TP-Link Devices ============================================================== Overview ======== Title:- Unauthenticated Stored Cross-site Scripting in TP-Link Devices. CVE-ID :-...

Weak password vulnerability in TP-LINK TL-ER6110G, TL-ER6120G, TL-ER6220G routers

TL-ER6110G, TL-ER6120G, TL-ER6220G are all TP-LINK routers. A weak password vulnerability exists in the TP-LINK TL-ER6110G, TL-ER6120G, TL-ER6220G routers, which can be exploited by attackers to obtain sensitive information...

Buffer Overflow Vulnerability in TP-Link Routers

TL-WDR8500 is a TP-LINK router product. The TP-Link router suffers from a buffer overflow vulnerability that can be exploited by an attacker to gain control of the server...

TP-Link Devices - (setDefaultHostname) Stored Cross-site Scripting Vulnerability

Multiple TP-Link devices suffer from an unauthenticated persistent cross site scripting vulnerability. Affected models include TD-W9977, TL-WA801ND, TL-WA801N, TL-WR802N, and Archer-C3150. ============================================================== Unauthenticated Stored Cross-site Scripting i...

Weak Password Vulnerability in TP-LINK Archer C5

Archer C5 is a wireless router product. A weak password vulnerability exists in TP-LINK Archer C5. An attacker can exploit the vulnerability to log into the system backend and obtain sensitive information...

TP-Link AC1750 sync-server Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of MAC addresses by the tdpServer endpoint. A...