Symlink Following Vulnerability in TP-Link Router Firmware
CVE-2020-5797

6.1MEDIUM

Key Information:

Vendor
Tp-link
Status
Tp-link Archer C9 A1
Vendor
CVE Published:
21 November 2020

Summary

A vulnerability in the TP-Link Archer C9(US)_V1_180125 firmware allows unauthenticated individuals with physical and network access to the router to exploit symbolic link following. By connecting a specially crafted USB drive to the router, an attacker can access and read sensitive files on the device. Additionally, the vulnerability permits writing to a limited set of files, further compromising the router's security and potential network integrity.

Affected Version(s)

TP-Link Archer C9 A1 Archer C9(US)_V1_180125 firmware

References

https://www.tenable.com/security/research/tra-2020-60
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.