TP-LINK AX10v1 1_211117 hard-coded key

Summaryinfo

A vulnerability described as critical has been identified in TP-LINK AX10v1 1_211117. This affects an unknown part. The manipulation results in hard-coded key. This vulnerability is identified as CVE-2022-41540. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in TP-LINK AX10v1 1_211117. Affected is an unknown code block. The manipulation with an unknown input leads to a hard-coded key vulnerability. CWE is classifying the issue as CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. This is going to have an impact on confidentiality. CVE summarizes:

The web app client of TP-Link AX10v1 V1_211117 uses hard-coded cryptographic keys when communicating with the router. Attackers who are able to intercept the communications between the web client and router through a man-in-the-middle attack can then obtain the sequence key via a brute-force attack, and access sensitive information.

The weakness was released 10/18/2022. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2022-41540 since 09/26/2022. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• TP-LINK

Name

• AX10v1

Version

• 1_211117

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion