Sign-up

ID

VAR-202103-0944


CVE

CVE-2021-27245


TITLE

TP-Link Archer A7  Vulnerability regarding a defect in the protection mechanism in

Trust: 0.8

sources: JVNDB: JVNDB-2021-004875

DESCRIPTION

This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-12309. Zero Day Initiative To this vulnerability ZDI-CAN-12309 Was numbered.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. TP-Link Archer A7 is a network router device

Trust: 2.88

sources: NVD: CVE-2021-27245 // JVNDB: JVNDB-2021-004875 // ZDI: ZDI-21-214 // CNVD: CNVD-2022-21175 // VULMON: CVE-2021-27245

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-21175

AFFECTED PRODUCTS

vendor:tp linkmodel:archer a7scope:ltversion:c7\(us\)_v5_210125

Trust: 1.0

vendor:tp linkmodel:archer a7scope:ltversion:a7\(us\)_v5_200220

Trust: 1.0

vendor:tp linkmodel:archer a7scope:eqversion: -

Trust: 0.8

vendor:tp linkmodel:archer a7scope:eqversion:archer a7 firmware archer c7 (us)_v5_210125

Trust: 0.8

vendor:tp linkmodel:archer a7scope:eqversion:archer a7 firmware archer a7 (us)_v5_200220 ac1750

Trust: 0.8

vendor:tp linkmodel:archer a7scope: - version: -

Trust: 0.7

vendor:nonemodel: - scope: - version: -

Trust: 0.6

sources: ZDI: ZDI-21-214 // CNVD: CNVD-2022-21175 // JVNDB: JVNDB-2021-004875 // NVD: CVE-2021-27245

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-27245
value: HIGH

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2021-27245
value: HIGH

Trust: 1.0

NVD: CVE-2021-27245
value: HIGH

Trust: 0.8

ZDI: CVE-2021-27245
value: HIGH

Trust: 0.7

CNVD: CNVD-2022-21175
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202103-1594
value: HIGH

Trust: 0.6

VULMON: CVE-2021-27245
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-27245
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-21175
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

zdi-disclosures@trendmicro.com: CVE-2021-27245
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2021-27245
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2021-27245
baseSeverity: HIGH
baseScore: 8.1
vectorString: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-21-214 // CNVD: CNVD-2022-21175 // VULMON: CVE-2021-27245 // JVNDB: JVNDB-2021-004875 // CNNVD: CNNVD-202103-1594 // NVD: CVE-2021-27245 // NVD: CVE-2021-27245

PROBLEMTYPE DATA

problemtype:CWE-693

Trust: 1.0

problemtype:Malfunction of protection mechanism (CWE-693) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-004875 // NVD: CVE-2021-27245

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202103-1594

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202103-1594

PATCH

title:Top Pageurl:https://www.tp-link.com/us/

Trust: 0.8

title:Patch for TP-Link Archer A7 Security Bypass Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/326736

Trust: 0.6

title:TP-Link Archer A7 Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=145604

Trust: 0.6

sources: CNVD: CNVD-2022-21175 // JVNDB: JVNDB-2021-004875 // CNNVD: CNNVD-202103-1594

EXTERNAL IDS

db:NVDid:CVE-2021-27245

Trust: 3.8

db:ZDIid:ZDI-21-214

Trust: 3.8

db:JVNDBid:JVNDB-2021-004875

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-12309

Trust: 0.7

db:CNVDid:CNVD-2022-21175

Trust: 0.6

db:CNNVDid:CNNVD-202103-1594

Trust: 0.6

db:VULMONid:CVE-2021-27245

Trust: 0.1

sources: ZDI: ZDI-21-214 // CNVD: CNVD-2022-21175 // VULMON: CVE-2021-27245 // JVNDB: JVNDB-2021-004875 // CNNVD: CNNVD-202103-1594 // NVD: CVE-2021-27245

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-21-214/

Trust: 3.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-27245

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/693.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2022-21175 // VULMON: CVE-2021-27245 // JVNDB: JVNDB-2021-004875 // CNNVD: CNNVD-202103-1594 // NVD: CVE-2021-27245

CREDITS

Team FLASHBACK: Pedro Ribeiro (@pedrib1337 | pedrib@gmail.com) + Radek Domanski (@RabbitPro)

Trust: 0.7

sources: ZDI: ZDI-21-214

SOURCES

db:ZDIid:ZDI-21-214
db:CNVDid:CNVD-2022-21175
db:VULMONid:CVE-2021-27245
db:JVNDBid:JVNDB-2021-004875
db:CNNVDid:CNNVD-202103-1594
db:NVDid:CVE-2021-27245

LAST UPDATE DATE

2024-11-23T22:33:06.716000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-21-214date:2021-03-19T00:00:00
db:CNVDid:CNVD-2022-21175date:2022-03-21T00:00:00
db:VULMONid:CVE-2021-27245date:2021-04-01T00:00:00
db:JVNDBid:JVNDB-2021-004875date:2021-12-01T09:03:00
db:CNNVDid:CNNVD-202103-1594date:2021-04-02T00:00:00
db:NVDid:CVE-2021-27245date:2024-11-21T05:57:40.570

SOURCES RELEASE DATE

db:ZDIid:ZDI-21-214date:2021-02-24T00:00:00
db:CNVDid:CNVD-2022-21175date:2021-03-21T00:00:00
db:VULMONid:CVE-2021-27245date:2021-03-29T00:00:00
db:JVNDBid:JVNDB-2021-004875date:2021-12-01T00:00:00
db:CNNVDid:CNNVD-202103-1594date:2021-03-29T00:00:00
db:NVDid:CVE-2021-27245date:2021-03-29T21:15:12.953