Web Application Vulnerability in TP-Link AX10 Router
CVE-2022-41540
5.9MEDIUM
Key Information:
- Vendor
- Tp-link
- Status
- Vendor
- CVE Published:
- 18 October 2022
Badges
👾 Exploit Exists🟡 Public PoC
Summary
The TP-Link AX10 web application client employs hard-coded cryptographic keys for communications with the router. This flaw allows attackers to exploit man-in-the-middle scenarios, gaining the ability to intercept and access sensitive data. By executing a brute-force attack, adversaries can decipher the hard-coded sequence key, potentially compromising user information transmitted between the client and router.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
- 🟡
Public PoC available
- 👾
Exploit known to exist