Password Disclosure Vulnerability in TP-Link Wireless Devices
CVE-2020-35575
9.8CRITICAL
Key Information:
- Vendor
Tp-link
- Status
- Vendor
- CVE Published:
- 26 December 2020
Badges
👾 Exploit Exists🟡 Public PoC🟣 EPSS 35%
What is CVE-2020-35575?
A vulnerability exists in the web interface of specific TP-Link wireless devices, where a remote attacker can exploit a password disclosure flaw to gain full administrative access to the web panel. This issue affects various models, including the WA901ND (prior to version 3.16.9(201211) beta), Archer C5, Archer C7, and several others, which may leave them susceptible to unauthorized control and manipulation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
EPSS Score
35% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved