CVE-2013-2645: CSRF
Multiple cross-site request forgery (CSRF) vulnerabilities on the TP-LINK WR1043N router with firmware TL-WR1043NDV1120405 allow remote attackers to hijack the authentication of administrators for requests that (1) enable FTP access (aka "FTP directory traversal") to /tmp via the shareEntire parameter to userRpm/NasFtpCfgRpm.htm, (2) change the FTP administrative password via the nasadminpwd parameter to userRpm/NasUserAdvRpm.htm, (3) enable FTP on the WAN interface via the internetA parameter to userRpm/NasFtpCfgRpm.htm, (4) launch the FTP service via the startFtp parameter to userRpm/NasFtpCfgRpm.htm, or (5) enable or disable bandwidth limits via the QoSCtrl parameter to userRpm/QoSCfgRpm.htm.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2645?
CVE-2013-2645 is rated as a medium severity vulnerability due to the potential for unauthorized access and control of the TP-LINK WR1043N router.
How do I fix CVE-2013-2645?
To mitigate CVE-2013-2645, users should upgrade the router firmware to the latest version available from TP-LINK.
What are the impacts of CVE-2013-2645?
CVE-2013-2645 allows remote attackers to perform cross-site request forgery, potentially compromising the router's admin authentication.
Who is affected by CVE-2013-2645?
CVE-2013-2645 affects users of the TP-LINK WR1043N router running the firmware version TL-WR1043ND_V1_120405.
Is CVE-2013-2645 easy to exploit?
Yes, CVE-2013-2645 can be exploited easily through crafted web requests that are sent to the affected router.