high7.5
CVE-2018-3949
An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN.
Impact
An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN. A specially crafted URL can cause a directory traversal, resulting in the disclosure of sensitive system files. An attacker can send either an unauthenticated or an authenticated web request to trigger this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Tl-R600vpn Firmware | Versions 1.3.0, 1.2.3 |