CVE-2018-11714 - An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices

Back Back to CVE browser

CRITICAL

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices

Published Jun 4, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 68.05%

Description

An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-384

References (2)

http://blog.securelayer7.net/time-to-disable-tp-link-home-wifi-router/
x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/44781/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://blog.securelayer7.net/time-to-disable-tp-link-home-wifi-router/		x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/44781/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 4, 2018

Updated Sep 16, 2024

Reserved Jun 4, 2018

Link CVE-2018-11714

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-11714

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-11714