CVE-2019-13268

{"id": "CVE-2019-13268", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2019-08-27T18:15:10.950", "references": [{"url": "https://orenlab.sise.bgu.ac.il/publications/CrossRouter", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.usenix.org/system/files/woot19-paper_ovadia.pdf", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)"}, {"lang": "es", "value": "Los dispositivos TP-Link Archer C3200 V1 y Archer C2 V1 tienen una compartimentaci\u00f3n insuficiente entre una red host y una red de invitados establecida por el mismo dispositivo. Reenv\u00edan las peticiones ARP, que se env\u00edan como paquetes de broadcast, entre el host y las redes de invitados. Para utilizar esta fuga como un canal encubierto directo, el remitente puede emitir trivialmente una solicitud ARP a un equipo arbitrario de la red. (En general, algunos routers restringen el reenv\u00edo ARP solo a las solicitudes destinadas a la m\u00e1scara de subred de la red, pero estos enrutadores no restringieron este tr\u00e1fico de ninguna manera. Dependiendo de este factor, uno debe utilizar los 8 bits m\u00e1s bajos de la direcci\u00f3n IP, o los 32 bits enteros, como la carga \u00fatil de datos.)"}], "lastModified": "2019-09-04T00:46:52.943", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c3200_v1_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0252646-692B-488E-9A79-B698030DF7AC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c3200_v1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7E4EE5DB-AE33-4F3E-A211-179A524F4DEA"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:archer_c2_v1_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CECD65D5-4F10-422F-B71E-6494D56B80A2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:archer_c2_v1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "10AEB762-E804-46FF-B37D-5CC21A1EFEB7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}