TP-LINK WDR4300 HTML Injection and Denial of Service Vulnerabilities
BID:70037
Info
TP-LINK WDR4300 HTML Injection and Denial of Service Vulnerabilities
| Bugtraq ID: | 70037 |
| Class: | Unknown |
| CVE: |
CVE-2014-4727 CVE-2014-4728 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 21 2014 12:00AM |
| Updated: | Sep 25 2014 12:02AM |
| Credit: | Oz Elisyan |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
TP-LINK WDR4300 HTML Injection and Denial of Service Vulnerabilities
TP-LINK WDR4300 is prone to an HTML-injection vulnerability and a denial-of-service vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to cause denial-of-service conditions or execute attacker-supplied HTML or script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
TP-LINK WDR4300 running firmware version 130617 is vulnerable; other versions may also be affected.
TP-LINK WDR4300 is prone to an HTML-injection vulnerability and a denial-of-service vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage these issues to cause denial-of-service conditions or execute attacker-supplied HTML or script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
TP-LINK WDR4300 running firmware version 130617 is vulnerable; other versions may also be affected.
Exploit / POC
TP-LINK WDR4300 HTML Injection and Denial of Service Vulnerabilities
The researcher has created exploits to demonstrate these issues. Please see the references for more information.
The researcher has created exploits to demonstrate these issues. Please see the references for more information.
Solution / Fix
TP-LINK WDR4300 HTML Injection and Denial of Service Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
TP-LINK WDR4300 HTML Injection and Denial of Service Vulnerabilities
References:
References: