← Back

CVE-2018-3948

nvd nist
Published: Nov 30, 2018Modified: Nov 21, 2024

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause the server to stop responding to requests, resulting in downtime for the management portal. An attacker can send either an unauthenticated or authenticated web request to trigger this vulnerability.

Affected (2)

Tp Link
1 product
Tl R600vpn Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl R600vpn Firmware
Version 1.3.0
Running on/withPlatform Versions
Tp Link
Tl R600vpn
Version v3
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl R600vpn Firmware
Version 1.2.3
Running on/withPlatform Versions
Tp Link
Tl R600vpn
Version v2

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

Source: talos-cna@cisco.com
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory

Timeline

No history available yet.