Improper input validation in TP-Link Tl-R600vpn
CVE-2018-3948
An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause the server to stop responding to requests, resulting in downtime for the management portal. An attacker can send either an unauthenticated or authenticated web request to trigger this vulnerability.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.231 (97.7th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.231 · newest: 0.231 · change: 0.000
Affected products
- TP-Link Tl-R600vpn — versions v3, v2
- TP-Link Tl-R600vpn Firmware — versions 1.3.0, 1.2.3
- TP-Link — versions TP-Link TL-R600VPN HWv3 FRNv1.3.0 TP-Link TL-R600VPN HWv2 FRNv1.2.3
Weakness classification (CWE)
References
- talosintelligence.com/vulnerability_reports/TALOS-2018-0617 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-3948?
- CVE-2018-3948 is a high-severity vulnerability in TP-Link Tl-R600vpn, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-11-30.
- How severe is CVE-2018-3948?
- High severity. CVSS v3 base score is 7.5 out of 10.