CVE-2025-14738

Опубликовано: 18 дек. 2025

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527,

≤

WA850RE V3_160922.

Ссылки

https://blog.exodusintel.com/2022/06/23/tp-link-wa850re-unauthenticated-configuration-disclosure-vulnerability/
Third Party Advisory
https://www.tp-link.com/us/support/download/tl-wa850re/v2/#Firmware
Product
https://www.tp-link.com/us/support/download/tl-wa850re/v3/#Firmware
Product
https://www.tp-link.com/us/support/faq/4848/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:tp-link:tl-wa850re_firmware:*:*:*:*:*:*:*:*

Версия до 160527 (включая)

cpe:2.3:h:tp-link:tl-wa850re:2:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:tp-link:tl-wa850re_firmware:*:*:*:*:*:*:*:*

Версия до 160922 (включая)

cpe:2.3:h:tp-link:tl-wa850re:3:*:*:*:*:*:*:*

EPSS

Процентиль: 35%

0.0014

Низкий

7.5 High

CVSS3

Дефекты

CWE-287

NVD-CWE-noinfo

Связанные уязвимости

GHSA-pjcq-qf93-gjgv

CVSS3: 7.5

github

около 2 месяцев назад

Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects: ≤ WA850RE V2_160527, ≤ WA850RE V3_160922.

BDU:2026-00034

CVSS3: 4.3

fstec