Advisory Details

November 14th, 2023

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability

CVE ID	CVE-2023-44447
CVSS SCORE	6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AFFECTED VENDORS	TP-Link
AFFECTED PRODUCTS	TL-WR902AC
VULNERABILITY DETAILS	This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
ADDITIONAL DETAILS	Fixed in TL-WR902AC(EU)_V1_231027 and TL-WR902AC(US)_V1_231025 https://www.tp-link.com/en/support/download/tl-wr902ac/v1/#Firmware https://www.tp-link.com/us/support/download/tl-wr902ac/v1/#Firmware
DISCLOSURE TIMELINE	2023-08-03 - Vulnerability reported to vendor 2023-11-14 - Coordinated public release of advisory
CREDIT	Aleksandar Djurdjevic 'revengsmK'

BACK TO ADVISORIES