CVE-2022-4499
High
Description
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Tp-link Archer C5 Firmware
PublishedJan 11, 2023
First seenJan 11, 2023
Weakness typeCWE-676CWE-676
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link archer_c5_firmware | 2_160201_us | — |
| tp-link tl-wr710n_firmware | 1_151022_us | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.