CVE-2022-4499: tp-link archer_c5_firmware Observable Discrepancy

Vulnerability summary

CVE-2022-4499 is a high (CVSS 7.5) Observable Discrepancy vulnerability in tp-link archer_c5_firmware. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.8% of scored vulnerabilities.

Timeline

1. 11-01-2023
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.

• CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.