HTML Injection Vulnerability in TP-Link TL-WR740N and TL-WR740ND Devices
CVE-2020-14965

4.8MEDIUM

Key Information:

Vendor
Tp-link
Status
Tl-wr740n Firmware
Vendor
CVE Published:
23 June 2020

Badges

👾 Exploit Exists🟡 Public PoC

Summary

The TP-Link TL-WR740N v4 and TL-WR740ND v4 devices are susceptible to an HTML injection vulnerability that allows attackers with access to the admin panel to inject malicious HTML code. This can alter the HTML content of the target pages and modify access-control settings through 'targets_lists_name' or 'hosts_lists_name'. Furthermore, the flaw can be exploited via Cross-Site Request Forgery (CSRF), meaning even unauthenticated users can execute the injection without needing admin privileges.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-14965
Created by g-rubert

References

https://github.com/g-rubert/CVE-2020-14965
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.