Authenticated Directory Traversal Vulnerability in File Upload Functionality in TP-Link TL-MR6400 and Archer MR600
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n, MR600(EU)_V3_1.4.0 Build 260827, MR600(EU)_V5_1.9.0 Build 260805, MR600(EU)_V2_1.12.0 Build 2600826
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory. Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- TP-Link Systems Inc. TL-MR6400 v8
fixed in 1.5.0 0.9.1 v0001.0 Build 260610 Rel.67978n
- TP-Link Systems Inc. Archer MR600
From v3 · fixed in MR600(EU)_V3_1.4.0 Build 260827; From v5 · fixed in MR600(EU)_V5_1.9.0 Build 260805; From v2 · fixed in MR600(EU)_V2_1.12.0 Build 2600826