Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2022-4499

The strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
certcc

Description

TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TP-Link WR710N

  • V1-151022affected

TP-Link Archer C5

  • V2_160221_USaffected

References