Insufficient Compartmentalization in TP-Link Archer C3200 and Archer C2 Products

CVE-2019-13266

Summary

The TP-Link Archer C3200 V1 and Archer C2 V1 devices exhibit insufficient compartmentalization between the host and guest networks. When a DHCP Request is sent with a specific Transaction ID, the router's response can erroneously allow the same Transaction ID to be sent to both networks. This flaw enables potential data encoding transmissions to be directed across the router, creating a risk of unauthorized data access and communication between isolated networks.

References