Sign-up

ID

VAR-202001-0288


CVE

CVE-2019-17147


TITLE

TP-LINK TL-WR841N Classic buffer overflow vulnerability in router

Trust: 0.8

sources: JVNDB: JVNDB-2019-014045

DESCRIPTION

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 80 by default. When parsing the Host request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8457. TP-LINK TL-WR841N The router contains a classic buffer overflow vulnerability. Zero Day Initiative Does not address this vulnerability ZDI-CAN-8457 Was numbered.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. TP-Link TL-WR841N is a wireless router from China TP-Link. The vulnerability originates from a network system or product that incorrectly validates data boundaries when performing operations on memory, causing incorrect read and write operations to be performed on other associated memory locations

Trust: 2.88

sources: NVD: CVE-2019-17147 // JVNDB: JVNDB-2019-014045 // ZDI: ZDI-19-992 // CNVD: CNVD-2019-46402 // VULMON: CVE-2019-17147

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-46402

AFFECTED PRODUCTS

vendor:tp linkmodel:tl-wr841nscope: - version: -

Trust: 1.5

vendor:tp linkmodel:tl-wr841nscope:eqversion:0.9.1_4.16

Trust: 1.0

vendor:tp linkmodel:tp-link tl-wr841nscope: - version: -

Trust: 0.6

sources: ZDI: ZDI-19-992 // CNVD: CNVD-2019-46402 // JVNDB: JVNDB-2019-014045 // NVD: CVE-2019-17147

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-17147
value: HIGH

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2019-17147
value: HIGH

Trust: 1.0

NVD: CVE-2019-17147
value: HIGH

Trust: 0.8

ZDI: CVE-2019-17147
value: HIGH

Trust: 0.7

CNVD: CNVD-2019-46402
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201911-1414
value: HIGH

Trust: 0.6

VULMON: CVE-2019-17147
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-17147
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2019-46402
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2019-17147
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2019-17147
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.0

NVD: CVE-2019-17147
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2019-17147
baseSeverity: HIGH
baseScore: 8.8
vectorString: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-19-992 // CNVD: CNVD-2019-46402 // VULMON: CVE-2019-17147 // JVNDB: JVNDB-2019-014045 // CNNVD: CNNVD-201911-1414 // NVD: CVE-2019-17147 // NVD: CVE-2019-17147

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.8

sources: JVNDB: JVNDB-2019-014045 // NVD: CVE-2019-17147

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1414

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201911-1414

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-014045

PATCH
title:Download for TL-WR841N V14url:https://www.tp-link.com/us/support/download/tl-wr841n/#Firmware
Trust: 0.8
title:TP-Link has issued an update to correct this vulnerability.#Firmwareurl:https://www.tp-link.com/us/support/download/tl-wr841n/
Trust: 0.7
title:Patch for TP-Link TL-WR841N Buffer Overflow Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/194735
Trust: 0.6
title:TP-Link TL-WR841N Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106538
Trust: 0.6
title:CVE-2019-17147_Practice_Materialurl:https://github.com/DrmnSamoLiu/CVE-2019-17147_Practice_Material 
Trust: 0.1
title: - url:https://github.com/khulnasoft-lab/awesome-security 
Trust: 0.1
sources:
            
            
            ZDI: ZDI-19-992 // 
            
            
            
            CNVD: CNVD-2019-46402 // 
            
            
            
            VULMON: CVE-2019-17147 // 
            
            
            
            JVNDB: JVNDB-2019-014045 // 
            
            
            
            CNNVD: CNNVD-201911-1414

EXTERNAL IDS
db:NVDid:CVE-2019-17147
Trust: 3.8
db:ZDIid:ZDI-19-992
Trust: 3.8
db:JVNDBid:JVNDB-2019-014045
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-8457
Trust: 0.7
db:CNVDid:CNVD-2019-46402
Trust: 0.6
db:CNNVDid:CNNVD-201911-1414
Trust: 0.6
db:VULMONid:CVE-2019-17147
Trust: 0.1
sources:
            
            
            ZDI: ZDI-19-992 // 
            
            
            
            CNVD: CNVD-2019-46402 // 
            
            
            
            VULMON: CVE-2019-17147 // 
            
            
            
            JVNDB: JVNDB-2019-014045 // 
            
            
            
            CNNVD: CNNVD-201911-1414 // 
            
            
            
            NVD: CVE-2019-17147

REFERENCES
url:https://www.zerodayinitiative.com/advisories/zdi-19-992/
Trust: 3.7
url:https://www.tp-link.com/us/support/download/tl-wr841n/#firmware
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-17147
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17147
Trust: 0.8
url:https://www.tp-link.com/us/support/download/tl-wr841n/
Trust: 0.7
url:https://cwe.mitre.org/data/definitions/120.html
Trust: 0.1
url:https://github.com/drmnsamoliu/cve-2019-17147_practice_material
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            ZDI: ZDI-19-992 // 
            
            
            
            CNVD: CNVD-2019-46402 // 
            
            
            
            VULMON: CVE-2019-17147 // 
            
            
            
            JVNDB: JVNDB-2019-014045 // 
            
            
            
            CNNVD: CNNVD-201911-1414 // 
            
            
            
            NVD: CVE-2019-17147

CREDITS
Nguyen Hoang Thach - Security Researcher at VNPT ISC
Trust: 1.3
sources:
            
            
            ZDI: ZDI-19-992 // 
            
            
            
            CNNVD: CNNVD-201911-1414

SOURCES
db:ZDIid:ZDI-19-992
db:CNVDid:CNVD-2019-46402
db:VULMONid:CVE-2019-17147
db:JVNDBid:JVNDB-2019-014045
db:CNNVDid:CNNVD-201911-1414
db:NVDid:CVE-2019-17147

LAST UPDATE DATE
2024-11-23T22:16:40.683000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-19-992date:2019-11-26T00:00:00
db:CNVDid:CNVD-2019-46402date:2019-12-20T00:00:00
db:VULMONid:CVE-2019-17147date:2020-01-14T00:00:00
db:JVNDBid:JVNDB-2019-014045date:2020-01-27T00:00:00
db:CNNVDid:CNNVD-201911-1414date:2020-07-23T00:00:00
db:NVDid:CVE-2019-17147date:2024-11-21T04:31:47.390

SOURCES RELEASE DATE
db:ZDIid:ZDI-19-992date:2019-11-26T00:00:00
db:CNVDid:CNVD-2019-46402date:2019-12-20T00:00:00
db:VULMONid:CVE-2019-17147date:2020-01-07T00:00:00
db:JVNDBid:JVNDB-2019-014045date:2020-01-27T00:00:00
db:CNNVDid:CNNVD-201911-1414date:2019-11-26T00:00:00
db:NVDid:CVE-2019-17147date:2020-01-07T23:15:10.967