CVE-2023-49074 - Vulnerability Details - OpenCVE

A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861

History

No history.

MITRE

Status: PUBLISHED

Assigner: talos

Published: 2024-04-09T14:12:48.559Z

Updated: 2024-08-02T21:46:28.899Z

Reserved: 2023-11-21T14:38:31.718Z

Link: CVE-2023-49074

Vulnrichment

Updated: 2024-08-02T21:46:28.899Z

NVD

Status : Awaiting Analysis

Published: 2024-04-09T15:15:28.800

Modified: 2024-11-21T08:32:45.963

Link: CVE-2023-49074

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-49074", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "state": "PUBLISHED", "assignerShortName": "talos", "dateReserved": "2023-11-21T14:38:31.718Z", "datePublished": "2024-04-09T14:12:48.559Z", "dateUpdated": "2024-08-02T21:46:28.899Z"}, "containers": {"cna": {"affected": [{"vendor": "Tp-Link", "product": "AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)", "versions": [{"version": "v5.1.0 Build 20220926", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-749: Exposed Dangerous Method or Function", "type": "CWE", "cweId": "CWE-749"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-04-09T17:00:11.037Z"}, "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861"}], "credits": [{"lang": "en", "value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-49074", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-15T15:42:34.807142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:27:54.416Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:28.899Z"}, "title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:46:28.899Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-49074", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-15T15:42:34.807142Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:23.768Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"credits": [{"lang": "en", "value": "Discovered by the Vulnerability Discovery and Research team of Cisco Talos."}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Tp-Link", "product": "AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3)", "versions": [{"status": "affected", "version": "v5.1.0 Build 20220926"}]}], "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861", "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1861"}], "descriptions": [{"lang": "en", "value": "A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. A specially crafted series of network requests can lead to reset to factory settings. An attacker can send a sequence of unauthenticated packets to trigger this vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-749", "description": "CWE-749: Exposed Dangerous Method or Function"}]}], "providerMetadata": {"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "shortName": "talos", "dateUpdated": "2024-04-09T17:00:11.037Z"}}}, "cveMetadata": {"cveId": "CVE-2023-49074", "state": "PUBLISHED", "dateUpdated": "2024-08-02T21:46:28.899Z", "dateReserved": "2023-11-21T14:38:31.718Z", "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b", "datePublished": "2024-04-09T14:12:48.559Z", "assignerShortName": "talos"}, "dataVersion": "5.1"}