CVE-2024-57050

Published Feb 18, 2025

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-57050 is a vulnerability found in TP-Link WR840N v6 routers with firmware version 0.9.1 4.16 and earlier. It allows unauthorized individuals to bypass authentication on some interfaces within the /cgi directory. The vulnerability can be exploited by adding `Referer: http://tplinkwifi.net` to a request, which the router incorrectly recognizes as valid authentication, granting unauthorized access.

Description: A vulnerability in the TP-Link WR840N v6 router with firmware version 0.9.1 4.16 and earlier permits unauthorized individuals to bypass the authentication of some interfaces under the /cgi directory.When adding Referer: http://tplinkwifi.net to the the request, it will be recognized as passing the authentication.
Source: cve@mitre.org
NVD status: Analyzed
Products: wr840n_firmware

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-287

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:tp-link:wr840n_firmware:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "9921C785-A6AB-4E22-B8AE-791C2E774483",
            "versionEndIncluding": "0.9.1_4.16",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:tp-link:wr840n:6:*:*:*:*:*:*:*",
            "matchCriteriaId": "79A291AB-FA6F-452E-90B3-2F705A86F83A",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.