CVE-2018-3949

An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a directory traversal, resulting in the disclosure of sensitive system files. An attacker can send either an unauthenticated or an authenticated web request to trigger this vulnerability.
References
Link Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0618 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tp-link:tl-r600vpn_firmware:1.3.0:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-r600vpn:3:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:tp-link:tl-r600vpn_firmware:1.2.3:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-r600vpn:2:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-12-01 03:29

Updated : 2023-12-10 12:44


NVD link : CVE-2018-3949

Mitre link : CVE-2018-3949

CVE.ORG link : CVE-2018-3949


JSON object : View

Products Affected

tp-link

  • tl-r600vpn_firmware
  • tl-r600vpn
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')