The strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.

CVE-2022-4499

What is CVE-2022-4499?

The Archer C5 and WR710N-V1 routers by TP-Link utilize the strcmp function within their httpd process for credential verification. This implementation flaw makes these routers vulnerable to side-channel attacks, allowing attackers to infer sensitive usernames and passwords by analyzing the response times of the httpd process. Such timing attacks can lead to unauthorized access, making it crucial for users to assess their router's security configurations.

References