CVE-2019-13267
First published: Tue Aug 27 2019(Updated: )
TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. In order to transfer data from the host network to the guest network, the sender joins and then leaves an IGMP group. After it leaves, the router (following the IGMP protocol) creates an IGMP Membership Query packet with the Group IP and sends it to both the Host and the Guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tp-link Archer C3200 V1 Firmware | ||
| TP-Link Archer C3200 V1 | ||
| Tp-link Archer C2 V1 Firmware | ||
| Tp-link Archer C2 V1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-13267?
CVE-2019-13267 is a vulnerability found in TP-Link Archer C3200 V1 and Archer C2 V1 devices that allows insufficient compartmentalization between a host network and a guest network.
How does CVE-2019-13267 work?
CVE-2019-13267 exploits the lack of compartmentalization by allowing data transfer from the host network to the guest network by joining and leaving an IGMP group.
What is the severity of CVE-2019-13267?
CVE-2019-13267 has a severity rating of 8.8 (high).
Which devices are affected by CVE-2019-13267?
TP-Link Archer C3200 V1 and Archer C2 V1 devices are affected by CVE-2019-13267.
How can I fix CVE-2019-13267?
To fix CVE-2019-13267, it is recommended to update the firmware of the TP-Link Archer C3200 V1 and Archer C2 V1 devices to the latest version provided by TP-Link.
- collector/nvd-index
- agent/references
- agent/severity
- agent/author
- agent/event
- agent/tags
- agent/type
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/tp-link
- canonical/tp-link archer c3200 v1 firmware
- canonical/tp-link archer c3200 v1
- canonical/tp-link archer c2 v1 firmware
- canonical/tp-link archer c2 v1