CVE-2019-13268: Input Validation
First published: Tue Aug 27 2019(Updated: )
TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tp-link Archer C3200 V1 Firmware | ||
| TP-Link Archer C3200 V1 | ||
| Tp-link Archer C2 V1 Firmware | ||
| Tp-link Archer C2 V1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this TP-Link Archer C3200 and Archer C2 vulnerability?
The vulnerability ID for this TP-Link Archer C3200 and Archer C2 vulnerability is CVE-2019-13268.
What is the severity level of CVE-2019-13268?
The severity level of CVE-2019-13268 is high.
What is the affected software for this vulnerability?
The affected software for this vulnerability includes TP-Link Archer C3200 V1 Firmware and TP-Link Archer C2 V1 Firmware.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-20.
Are TP-Link Archer C3200 V1 and Archer C2 V1 devices vulnerable to this vulnerability?
TP-Link Archer C3200 V1 and Archer C2 V1 devices are not vulnerable to this vulnerability.
- collector/nvd-index
- agent/weakness
- agent/tags
- agent/event
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/description
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/tp-link
- canonical/tp-link archer c3200 v1 firmware
- canonical/tp-link archer c3200 v1
- canonical/tp-link archer c2 v1 firmware
- canonical/tp-link archer c2 v1