CVE-2021-3275

Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL…

published March 26, 2021

CVSS
—
EPSS
2%
Percentile
78.2
In the wild
Unconfirmed
What it is

Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL Gateways and Routers, which affects TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, and Archer C3150v2 devices through the improper validation of the hostname. Some of the pages including dhcp.htm, networkMap.htm, dhcpClient.htm, qsEdit.htm, and qsReview.htm and use this vulnerable hostname function (setDefaultHostname()) without sanitization.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01788 · 78.2th percentile
Published
2021-03-26T12:21Z
EPSS history
Timeline
  • 26 MAR 12:21Z
    Unauthenticated stored cross-site scripting (XSS) exists in multiple TP-Link products including WIFI Routers (Wireless AC routers), Access Points, ADSL + DSL…
    cvelistv5