JVN#29657972
TP-Link RE300 V1 tdpServer vulnerable to improper processing of its input
Overview
tdpServer of TP-Link RE300 V1 improperly processes its input, possibly resulting to crash.
Products Affected
- TP-Link RE300 V1 firmware versions prior to 221009
Description
tdpServer of TP-Link RE300 V1 improperly processes its input, possibly resulting to crash (CWE-228).
Impact
An attacker may be able to cause a denial-of-service (DoS) condition of the product's OneMesh function.
Solution
Update the software
Update the software to the latest version according to the information provided by the developer.
This vulnerability has been addressed in the firmware version 221009.
Vendor Status
| Vendor | Link |
| TP-Link | Download for RE300 V1 |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
Tomoya Kitagawa and Toshiki Takatera of Ricerca Security, Inc. reported this vulnerability to the developer and coordinated. After coordination was completed, this case was reported to JPCERT/CC and JPCERT/CC coordinated with the developer for the publication.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2022-41783 |
| JVN iPedia |
JVNDB-2022-000093 |