Vulnerabilities > TP Link

DATE CVE VULNERABILITY TITLE RISK
2020-11-08 CVE-2020-28347 OS Command Injection vulnerability in Tp-Link Ac1750 Firmware 190726
tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter.
network
low complexity
tp-link CWE-78
critical
 9.8
9.8
2020-11-06 CVE-2020-5795 Link Following vulnerability in Tp-Link Archer A7 Firmware 200721
UNIX Symbolic Link (Symlink) Following in TP-Link Archer A7(US)_V5_200721 allows an authenticated admin user, with physical access and network access, to execute arbitrary code after plugging a crafted USB drive into the router.
low complexity
tp-link CWE-59
6.2
6.2
2020-08-31 CVE-2020-24363 Missing Authentication for Critical Function vulnerability in Tp-Link Tl-Wa855Re Firmware 20200415
TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot.
low complexity
tp-link CWE-306
8.8
8.8
2020-08-07 CVE-2020-15057 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Tp-Link Tl-Ps310U Firmware
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to denial-of-service the device via long input values.
low complexity
tp-link CWE-119
6.5
6.5
2020-08-07 CVE-2020-15056 Cross-site Scripting vulnerability in Tp-Link Tl-Ps310U Firmware
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
low complexity
tp-link CWE-79
4.3
4.3
2020-08-07 CVE-2020-15055 Improper Authentication vulnerability in Tp-Link Tl-Ps310U Firmware
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
low complexity
tp-link CWE-287
8.8
8.8
2020-08-07 CVE-2020-15054 Insufficiently Protected Credentials vulnerability in Tp-Link Tl-Ps310U Firmware
TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
low complexity
tp-link CWE-522
8.8
8.8
2020-06-23 CVE-2020-14965 Cross-site Scripting vulnerability in Tp-Link Tl-Wr740N Firmware and Tl-Wr740Nd Firmware
On TP-Link TL-WR740N v4 and TL-WR740ND v4 devices, an attacker with access to the admin panel can inject HTML code and change the HTML context of the target pages and stations in the access-control settings via targets_lists_name or hosts_lists_name.
network
low complexity
tp-link CWE-79
4.8
4.8
2020-06-17 CVE-2020-13224 Classic Buffer Overflow vulnerability in Tp-Link products
TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC230 devices through 1.3.1 build 200401, NC250 devices through 1.3.1 build 200401, NC260 devices through 1.5.3 build_200401, and NC450 devices through 1.5.4 build 200401 have a Buffer Overflow
network
low complexity
tp-link CWE-120
8.8
8.8
2020-06-08 CVE-2020-12695 Incorrect Default Permissions vulnerability in multiple products
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. 		7.5
7.5