CVE-2021-31659: tp-link tl-sg2005_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2021-31659 is a high (CVSS 8.8) Cross-Site Request Forgery (CSRF) vulnerability in tp-link tl-sg2005_firmware. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-06-2021
   PublishedVulnerability first disclosed.
2. 09-07-2026
   Last modifiedVulnerability information updated.

Description

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is vulnerable to Cross Site Request Forgery (CSRF). All configuration information is placed in the URL, without any additional token authentication information. A malicious link opened by the switch administrator may cause the password of the switch to be modified and the configuration file to be tampered with.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.