← Back

CVE-2021-3275

nvd nist
Published: Mar 26, 2021Modified: Nov 21, 2024

JSON object

Loading...
6.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.7
Source: NVD

Description

Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.

Affected (5)

Tp Link
5 products
Td W9977 Firmware
Tl Wa801nd Firmware
Tl Wa801n Firmware
Tl Wr802n Firmware
Archer C3150 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Td W9977 Firmware
Version v1_0.1.0_0.9.1_up_boot(161123)_2016-11-23_15.36.15
Running on/withPlatform Versions
Tp Link
Td W9977
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl Wa801nd Firmware
Version v5_us_0.9.1_3.16_up_boot[170905-rel56404]
Running on/withPlatform Versions
Tp Link
Tl Wa801nd
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl Wa801n Firmware
Version v6_eu_0.9.1_3.16_up_boot[200116-rel61815]
Running on/withPlatform Versions
Tp Link
Tl Wa801n
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Tl Wr802n Firmware
Version v4_us_0.9.1_3.17_up_boot[200421-rel38950]
Running on/withPlatform Versions
Tp Link
Tl Wr802n
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Archer C3150 Firmware
Version v2_170926
Running on/withPlatform Versions
Tp Link
Archer C3150
All versions

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

Source: cve@mitre.org
ExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.