CVEvulnerability

CVE-2020-10916

8.0 HIGH Published 2020-05-07 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-05-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.0 HIGH — CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
8.0 HIGH — CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.2 MEDIUM — AV:A/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-287

Description

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of TP-Link TL-WA855RE Firmware Ver: 855rev4-up-ver1-0-1-P1[20191213-rel60361] Wi-Fi extenders. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the first-time setup process. The issue results from the lack of proper validation on first-time setup requests. An attacker can leverage this vulnerability to reset the password for the Admin account and execute code in the context of the device. Was ZDI-CAN-10003.

Affected configurations

• tp-link tl-wa855re firmware 190408 • tp-link tl-wa855re firmware 191213

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References