CVE-2022-4499

CVSS V2 None CVSS V3 None
Description
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
Overview
  • CVE ID
  • CVE-2022-4499
  • Assigner
  • cret@cert.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-11T19:15:10
  • Last Modified Date
  • 2023-01-19T16:08:38
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:o:tp-link:archer_c5_firmware:2_160201_us:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:tp-link:archer_c5:2.0:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:tp-link:tl-wr710n_firmware:1_151022_us:*:*:*:*:*:*:* 1 OR
cpe:2.3:h:tp-link:tl-wr710n:1.0:*:*:*:*:*:*:* 0 OR
References
Reference URL Reference Tags
https://kb.cert.org/vuls/id/572615
History
Created Old Value New Value Data Type Notes
2023-01-12 05:17:48 Added to TrackCVE
2023-01-12 05:17:50 Weakness Enumeration new
2023-01-18 16:16:13 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-19 16:15:16 2023-01-19T16:08:38 CVE Modified Date updated
2023-01-19 16:15:16 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-19 16:15:17 Weakness Enumeration update
2023-01-19 16:15:20 CPE Information updated