CVE-2022-43636: tp-link tl-wr940n_firmware Use of Insufficiently Random Values

Vulnerability summary

CVE-2022-43636 is a high (CVSS 8.8) Use of Insufficiently Random Values vulnerability in tp-link tl-wr940n_firmware. EPSS estimates a 0.91% chance of exploitation in the next 30 days, higher than 59.3% of scored vulnerabilities.

Timeline

1. 29-03-2023
   PublishedVulnerability first disclosed.
2. 12-02-2025
   Last modifiedVulnerability information updated.

Description

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link TL-WR940N 6_211111 3.20.1(US) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of sufficient randomness in the sequnce numbers used for session managment. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-18334.

• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.