CVE-2022-46430 - Vulnerability Details - OpenCVE

ReportizFlow

TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tp-link	Tl-wr740n V1 Tl-wr740n V1 Firmware Tl-wr740n V2 Tl-wr740n V2 Firmware Tl-wr741nd V1 Tl-wr741nd V1 Firmware Tl-wr741nd V2 Tl-wr741nd V2 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:tp-link:tl-wr740n_v1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tl-wr740n_v1:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:tp-link:tl-wr740n_v2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tl-wr740n_v2:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:tp-link:tl-wr741nd_v1_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tl-wr741nd_v1:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:tp-link:tl-wr741nd_v2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tl-wr741nd_v2:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJxlw2Pwi
https://www.tp-link.com/us/press/security-advisory/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-12-20T00:00:00

Updated: 2024-08-03T14:31:46.337Z

Reserved: 2022-12-05T00:00:00

Link: CVE-2022-46430

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-12-20T20:15:10.740

Modified: 2024-11-21T07:30:34.837

Link: CVE-2022-46430

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr740n_v1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6216D31E-6F5B-4FC3-836B-9D3DF24B172F", "versionEndIncluding": "3.12.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr740n_v1:-:*:*:*:*:*:*:*", "matchCriteriaId": "9C4A3C8A-A3D6-4FEC-A126-22CD97400EDD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr740n_v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1144CD75-99B3-4C23-BE5C-BAA0BECEE029", "versionEndIncluding": "3.12.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr740n_v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "02D3AAB7-A205-4DFF-982A-D1880FBE34BF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr741nd_v1_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "964746A7-5885-4511-A8DD-0EA5A186DEFC", "versionEndIncluding": "3.12.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr741nd_v1:-:*:*:*:*:*:*:*", "matchCriteriaId": "373F2118-342A-4F02-8CFE-470074E1D5CA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tl-wr741nd_v2_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "99CB191F-2A24-4334-94F3-206C0060BFE6", "versionEndIncluding": "3.12.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tl-wr741nd_v2:-:*:*:*:*:*:*:*", "matchCriteriaId": "B31BBFB1-BB93-4DCA-AA50-DB24DD4B43FA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process."}, {"lang": "es", "value": "TP-Link TL-WR740N V1 y V2 v3.12.4 y anteriores permiten a atacantes autenticados ejecutar c\u00f3digo arbitrario o provocar una Denegaci\u00f3n de Servicio (DoS) mediante la carga de una imagen de firmware manipulada durante el proceso de actualizaci\u00f3n del firmware."}], "id": "CVE-2022-46430", "lastModified": "2024-11-21T07:30:34.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2022-12-20T20:15:10.740", "references": [{"source": "[email protected]", "url": "https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJxlw2Pwi"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/press/security-advisory/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://hackmd.io/%40slASVrz_SrW7NQCsunofeA/BJxlw2Pwi"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/press/security-advisory/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-494"}], "source": "[email protected]", "type": "Primary"}]}