Plaintext Credential Transmission in TP-Link Routers
CVE-2024-46340

8.8HIGH

Key Information:

Vendor
TP-Link
Status
TL-WR845N
Vendor
CVE Published:
10 December 2024

Summary

The TP-Link TL-WR845N routers experience a significant security issue where user credentials are transmitted unencrypted in plaintext following a factory reset. This vulnerability exposes sensitive information that can be intercepted by malicious actors, compromising user account security and overall network integrity. Users of the affected TL-WR845N variants should take immediate precautions and consider updating their devices to mitigate the risks associated with this vulnerability.

References

https://security.iiita.ac.in/iot/factory-reset.docx

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.