Published: 27/01/2020 Updated: 01/02/2023

CVSS v2 Base Score: 4.1 | Impact Score: 4.9 | Exploitability Score: 5.1

CVSS v3 Base Score: 6.1 | Impact Score: 5.2 | Exploitability Score: 0.9

VMScore: 415

Vector: AV:A/AC:L/Au:S/C:P/I:P/A:N

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tp-link tl-wr849n_firmware 0.9.1_4.16

# Exploit Title: TL-WR849N 091 416 - Authentication Bypass (Upload Firmware) # Date: 2019-11-20 # Exploit Author: Elber Tavares # Vendor Homepage: wwwtp-linkcom/ # Software Link: wwwtp-linkcom/br/support/download/tl-wr849n/#Firmware # Version: TL-WR849N 091 416 # Tested on: linux, windows # CVE : CVE-CVE-2019-19143 Upload ...

TP-Link TL-WR849N version 091 416 suffers from a firmware upload authentication bypass vulnerability ...

OpenSource Repo with PoC's and vulns found in routers TP LINK TL-WR849N - REMOTE COMMAND EXECUTION PoC [CVE-2020-9374] - TP LINK TL-WR849N - REMOTE COMMAND EXECUTION PoC Payload: "$(ls)" TP LINK TL-WR849N - Auth Bypass: Firmware and Configs update TP LINK TL-WR849N - REMOTE COMMAND EXECUTION PoC Payload: curl -X GET -H

CWE-306 https://fireshellsecurity.team/hack-n-routers/http://packetstormsecurity.com/files/156586/TP-Link-TL-WR849N-0.9.1-4.16-Authentication-Bypass.html https://nvd.nist.gov https://github.com/ElberTavares/routers-exploit https://www.exploit-db.com/exploits/48152

CVE-2019-19143

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect