CVE-2022-4498 - In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP

CVE-2022-4498

Summary

In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafted packet that causes a heap overflow. This can result in either a DoS (by crashing the httpd process) or an arbitrary code execution.

References

https://kb.cert.org/vuls/id/572615

Vulnerable Configurations

cpe:2.3:o:tp-link:archer_c5_firmware:2_160201_us:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:archer_c5_firmware:2_160201_us:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:archer_c5:2.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:archer_c5:2.0:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:tl-wr710n_firmware:1_151022_us:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:tl-wr710n_firmware:1_151022_us:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-wr710n:1.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-wr710n:1.0:*:*:*:*:*:*:*

CVSS

Base:	None
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication

Impact

Confidentiality	Integrity	Availability

Last major update

06-07-2023 - 14:46

Published

11-01-2023 - 21:15

Last modified

06-07-2023 - 14:46