CVE-2022-4499: The strcmp function in TP-Link routers, Archer C5 and WR710N-V1, used for checking credentials in httpd, is susceptible to a side-channel attack.
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this TP-Link router vulnerability?
The vulnerability ID for this TP-Link router vulnerability is CVE-2022-4499.
Which TP-Link router models are affected by this vulnerability?
The TP-Link router models Archer C5 and WR710N-V1 using the latest software are affected by this vulnerability.
What is the severity level of CVE-2022-4499?
CVE-2022-4499 has a severity level of 7.5 (High).
What is the vulnerability description for CVE-2022-4499?
The vulnerability CVE-2022-4499 in TP-Link routers Archer C5 and WR710N-V1 allows an attacker to guess the username and password by measuring the response time of the httpd process.
Is my TP-Link Archer C5 router vulnerable to CVE-2022-4499?
If you are using the latest software, your TP-Link Archer C5 router may be vulnerable to CVE-2022-4499.
Is my TP-Link WR710N-V1 router vulnerable to CVE-2022-4499?
If you are using the latest software, your TP-Link WR710N-V1 router may be vulnerable to CVE-2022-4499.
How can an attacker exploit CVE-2022-4499?
An attacker can exploit CVE-2022-4499 by measuring the response time of the httpd process to guess each byte of the username and password.
Where can I find more information about CVE-2022-4499?
You can find more information about CVE-2022-4499 at the following reference: https://kb.cert.org/vuls/id/572615
What is the Common Weakness Enumeration (CWE) for CVE-2022-4499?
The Common Weakness Enumeration (CWE) for CVE-2022-4499 is CWE-203 and CWE-676.