VulnerabilityModified
CVE-2021-31658
This vulnerability will cause the application to crash, and all device configuration information will be erased.
HIGH 8.1EPSS 1.02%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application to crash, and all device configuration information will be erased.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 1.02% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-129
- Affected
- tp-link/tl-sg2005 firmware · tp-link/tl-sg2008 firmware
- Source
- cve@mitre.org
References
- https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31658Exploit, Third Party Advisory
- https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-31658Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.