5758 matches found
CVE-2017-8077
The CVE-2017-8077 issue affects the TP-Link TL-SG108E (firmware 1.1.2 Build 20141017 Rel.50749, 1.0). A hard-coded ciphering key (starts with Ei2HNryt) in the firmware is cited as the root cause. Red Hat and CNVD entries corroborate a vulnerability due to hard-coded encryption keys, with document...
CVE-2017-8077
On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key a long string beginning with Ei2HNryt. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
CVE-2017-8075: Insertion of Sensitive Information into Log File
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
CVE-2017-8078: Improper Authentication
On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication httpupg.cgi with a parameter called cmd. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
CVE-2017-8077: Use of Hard-coded Credentials
On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key a long string beginning with Ei2HNryt. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
CVE-2017-8074: Insertion of Sensitive Information into Log File
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
CVE-2017-8076: Inadequate Encryption Strength
On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware...
PT-2017-18102
Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749 Description A remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. Recommendations For TP-Link...
PT-2017-18105
Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749 Description The issue concerns a hard-coded ciphering key, which is a long string beginning with Ei2HNryt. This key is used for encryption purposes, but...
PT-2017-18103
Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749 Description A remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. Recommendations For TP-Link TL-SG10...
PT-2017-18104
Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 Description The issue concerns the use of RC4 encoding for admin network communications, despite RC4 being deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware. Recommendations For TP-Link TL-SG108...
PT-2017-18106
Name of the Vulnerable Software and Affected Versions TP-Link TL-SG108E version 1.0 TP-Link TL-SG108E firmware 1.1.2 Build 20141017 Rel.50749 Description The issue allows the upgrade process to be requested remotely without authentication. This is achieved through the httpupg.cgi endpoint with a...
RogueSploit - Powerfull social engeering Wi-Fi trap!
RogueSploit is an open source automated script made to create a Fake Acces Point, with dhcpd server, dns spoofing, host redirection, browserautopwn1 or autopwn2 or beef+mitmf. TO DO LIST: Add BeEF;DONE Add MITMF;DONE Add BDFProxy; Add SeToolkit; Add Hostapd as fake ap; Add some features; What you...
Multiple vulnerabilities in several TP-Link routers
The TP-LINK Archer C20i/C2 is a router from China P&L. A denial of service, security bypass, and command injection vulnerability exists in multiple TP-Link routers. An attacker could use this vulnerability to bypass some security restrictions to perform unauthorized operations, cause a denial of...
TP-Link C2 and C20i Denial of Service Vulnerability
TP-Link is a Chinese manufacturer of network equipment such as routers and IOT devices. A denial of service vulnerability exists in TP-Link C2 and C20i. An attacker can exploit the vulnerability to cause a denial of service by sending an HTTP request to the affected device, crashing the HTTP serv...
TP-Link C2 and C20i Default Credential Design Vulnerability
TP-Link is a Chinese manufacturer of network equipment such as routers, IOT devices, and more. A default credential design vulnerability exists in the vsftpd FTP server of the TP-Link C2 and C20i. An attacker can exploit the vulnerability to execute the system command multiple times and run with...
Updated Firmware Due for Serious TP-Link Router Vulnerabilities
Chinese router maker TP-Link is wrestling with the disclosure of a handful of vulnerabilities in its C2 and C20i routers. The most severe of the flaws lead to remote code execution on a device; the attack, however, would require an attacker first obtain valid credentials. Researcher Pierre Kim...
TP-Link C2 / C20i Command Injection / Denial Of Service
TP-Link CS and C20i are vulnerable to command injection, denial of service, and improper firewall rule issues. Title: TP-Link C2 and C20i vulnerable to command injection authenticated root RCE, DoS, improper firewall rules Advisory URL: https://pierrekim.github.io/advisories/2017-tplink-0x00.txt...
TP-Link C2 and C20i command injection Vulnerability
Product Description TP-Link is a Chinese manufacturer of computer networking products such as routers and IOT devices. Vulnerabilities Summary Command Injections exist in the HTTP management interface up to the latest firmware version 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n of TP-Link C2 and...
TP-Link C2 and C20i Command Injection Vulnerability
TP-Link is a Chinese manufacturer of network equipment such as routers and IOT devices. A command injection vulnerability exists in the http management interface of the TP-Link C2 and C20i. An attacker can exploit this vulnerability to inject arbitrary shell commands and gain root privileges...