EIP-9098806c
A vulnerability exists within the httpd server of the TP-Link WA850RE Universal Wi-Fi Range Extender that allows remote unauthenticated attackers to download the configuration file. Retrieval of this file results in the exposure of admin credentials and other sensitive information.
Vulnerability Identifiers
Exodus Intelligence: EIP-9098806c
MITRE CVE: TBD
Vulnerability Metrics
CVSSv2 Score: 8.3
Vendor References
850RE V2: https://www.tp-link.com/us/support/download/tl-wa850re/v2/#Firmware
850RE V3: https://www.tp-link.com/us/support/download/tl-wa850re/v3/#Firmware
Discovery Credit
Exodus Intelligence
Disclosure Timeline
Disclosed to affected vendor: December 10th, 2021
Disclosed to public: June 23rd, 2022
Further Information
Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].
Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program (RSP).
The post TP-Link WA850RE Unauthenticated Configuration Disclosure Vulnerability appeared first on Exodus Intelligence.
Support the originator by clicking the read the rest link below.
