VulnerabilityAnalyzed
CVE-2024-12343
A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021.
HIGH 7.1EPSS 4.72%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A vulnerability classified as critical has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected is an unknown function of the file /control/WANIPConnection of the component SOAP Request Handler. The manipulation of the argument NewConnectionType leads to buffer overflow. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 4.72% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-120
- Affected
- tp-link/vn020 f3v firmware
- Source
- cna@vuldb.com
References
- https://github.com/Zephkek/TP-WANPunch/blob/main/README.mdBroken Link
- https://vuldb.com/?ctiid.287262Permissions Required
- https://vuldb.com/?id.287262Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.446212Third Party Advisory, VDB Entry
- https://www.tp-link.com/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.