CVE-2020-35575
Critical
Description
A password-disclosure issue in the web interface on certain TP-Link devices allows a remote attacker to get full administrative access to the web panel. This affects WA901ND devices before 3.16.9(201211) beta, and Archer C5, Archer C7, MR3420, MR6400, WA701ND, WA801ND, WDR3500, WDR3600, WE843N, WR1043ND, WR1045ND, WR740N, WR741ND, WR749N, WR802N, WR840N, WR841HP, WR841N, WR842N, WR842ND, WR845N, WR940N, WR941HP, WR945N, WR949N, and WRD4300 devices.
SeverityCritical
CVSS9.8
Exploit probability95. percentile7.6%
Product
Tp-link Wa901nd Firmware
PublishedDec 26, 2020
First seenDec 26, 2020
How to fix
Update
- tp-link wa901nd_firmware3.16.9\(201211\)_beta or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link wa901nd_firmware | v < 3.16.9\(201211\)_beta | 3.16.9\(201211\)_beta |
| tp-link archer_c5_firmware | No range specified | — |
| tp-link archer_c7_firmware | No range specified | — |
| tp-link mr3420_firmware | No range specified | — |
| tp-link mr6400_firmware | No range specified | — |
| tp-link wa701nd_firmware | No range specified | — |
| tp-link wa801nd_firmware | No range specified | — |
| tp-link wdr3500_firmware | No range specified | — |
| tp-link wdr3600_firmware | No range specified | — |
| tp-link we843n_firmware | No range specified | — |
| tp-link wr1043nd_firmware | No range specified | — |
| tp-link wr1045nd_firmware | No range specified | — |
| tp-link wr740n_firmware | No range specified | — |
| tp-link wr741nd_firmware | No range specified | — |
| tp-link wr749n_firmware | No range specified | — |
| tp-link wr802n_firmware | No range specified | — |
| tp-link wr840n_firmware | No range specified | — |
| tp-link wr841hp_firmware | No range specified | — |
| tp-link wr841n_firmware | No range specified | — |
| tp-link wr842n_firmware | No range specified | — |
| tp-link wr842nd_firmware | No range specified | — |
| tp-link wr845n_firmware | No range specified | — |
| tp-link wr940n_firmware | No range specified | — |
| tp-link wr941hp_firmware | No range specified | — |
| tp-link wr945n_firmware | No range specified | — |
| tp-link wr949n_firmware | No range specified | — |
| tp-link wrd4300_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.