Remote Authentication Bypass in TP-Link Network Switch
CVE-2017-8078

5.3MEDIUM

Key Information:

Vendor
Tp-link
Status
Tl-sg108e Firmware
Vendor
CVE Published:
23 April 2017

Summary

The TP-Link TL-SG108E 1.0 network switch is vulnerable due to a remote authentication bypass issue, allowing attackers to initiate the firmware upgrade process without requiring authentication. This flaw occurs through the 'httpupg.cgi' endpoint with a command parameter, exposing the device to potential unauthorized firmware modifications. Users are advised to restrict access to the affected device and apply the latest firmware updates to mitigate this vulnerability.

References

https://chmod750.com/2017/04/23/vulnerability-disclosure-...
x_refsource_MISC
http://www.securityfocus.com/bid/97985
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.