TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the password of the switch to be modified and the configuration file to be tampered with.
References
| Link | Resource |
|---|---|
| http://tp-link.com | Vendor Advisory |
| https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31659 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
History
23 Jun 2021, 15:37
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-352 | |
| References | (MISC) https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31659 - Exploit, Third Party Advisory | |
| References | (MISC) http://tp-link.com - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 8.8 |
| CPE | cpe:2.3:o:tp-link:tl-sg2005_firmware:1.0.0:build_20180529_rel.40524:*:*:*:*:*:* cpe:2.3:o:tp-link:tl-sg2008_firmware:1.0.0:build_20180529_rel.40524:*:*:*:*:*:* cpe:2.3:h:tp-link:tl-sg2008:-:*:*:*:*:*:*:* cpe:2.3:h:tp-link:tl-sg2005:-:*:*:*:*:*:*:* |
10 Jun 2021, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-06-10 15:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-31659
Mitre link : CVE-2021-31659
CVE.ORG link : CVE-2021-31659
JSON object : View
Products Affected
tp-link
- tl-sg2008_firmware
- tl-sg2008
- tl-sg2005_firmware
- tl-sg2005
CWE
CWE-352
Cross-Site Request Forgery (CSRF)