Sensitive Information Disclosure in TP-Link TL-WR940N Routers

CVE-2022-43635

Summary

The vulnerability present in TP-Link TL-WR940N routers allows unauthorized network-adjacent attackers to gain access to sensitive information. The issue arises from a flaw in the httpd service running on TCP port 80, where the authentication algorithm has been incorrectly implemented. This vulnerability enables attackers to disclose stored credentials without requiring any form of authentication, paving the way for further attacks on the system.

References