This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P1[20191213-rel60361] Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the first-time setup process. The issue results from the lack of proper validation on first-time setup requests. An attacker can leverage this vulnerability to reset the password for the Admin account and execute code in the context of the device. Was ZDI-CAN-10003.
References
Link | Resource |
---|---|
https://www.zerodayinitiative.com/advisories/ZDI-20-553/ | Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: zdi
Published: 2020-05-07T22:20:12
Updated: 2020-05-07T22:20:12
Reserved: 2020-03-24T00:00:00
Link: CVE-2020-10916
JSON object: View
NVD Information
Status : Analyzed
Published: 2020-05-07T23:15:11.577
Modified: 2020-05-14T15:48:34.687
Link: CVE-2020-10916
JSON object: View
Redhat Information
No data.
CWE