Sensitive Information Disclosure in TP-Link TL-WR940N Router

CVE-2022-24972

Summary

A vulnerability in TP-Link TL-WR940N routers allows network-adjacent attackers to disclose sensitive information. The flaw exists in the httpd service, which by default listens on TCP port 80, lacking adequate access control. This absence of protection enables attackers to extract stored credentials without requiring authentication, potentially leading to further system compromise. For more details, refer to the advisory from Zero Day Initiative.

References