CVE-2024-46340

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-46340
TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://security.iiita.ac.in/iot/factory-reset.docx Third Party Advisory
https://security.iiita.ac.in/iot/factory-reset.docx Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:tp-link:tl-wr845n_firmware:201214:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-wr845n:v4:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:tp-link:tl-wr845n_firmware:200909:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-wr845n:v4:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:tp-link:tl-wr845n_firmware:190219:*:*:*:*:*:*:*
cpe:2.3:h:tp-link:tl-wr845n:v4:*:*:*:*:*:*:*
History

20 Jun 2025, 18:51

Type Values Removed Values Added
References () https://security.iiita.ac.in/iot/factory-reset.docx - () https://security.iiita.ac.in/iot/factory-reset.docx - Third Party Advisory
First Time Tp-link tl-wr845n Firmware
Tp-link tl-wr845n
Tp-link
CPE cpe:2.3:h:tp-link:tl-wr845n:v4:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:tl-wr845n_firmware:200909:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:tl-wr845n_firmware:190219:*:*:*:*:*:*:*
cpe:2.3:o:tp-link:tl-wr845n_firmware:201214:*:*:*:*:*:*:*

03 Apr 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 9.8

28 Jan 2025, 23:15

Type Values Removed Values Added
Summary
  • (es) Se descubrió que TP-Link TL-WR845N(UN)_V4_200909 y TL-WR845N(UN)_V4_190219 transmitían credenciales de usuario en texto plano después de ejecutar un restablecimiento de fábrica.
Summary (en) TP-Link TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset. (en) TL-WR845N(UN)_V4_201214, TP-Link TL-WR845N(UN)_V4_200909, and TL-WR845N(UN)_V4_190219 was discovered to transmit user credentials in plaintext after executing a factory reset.

11 Dec 2024, 15:15

Type Values Removed Values Added
CWE CWE-312
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://security.iiita.ac.in/iot/factory-reset.docx - () https://security.iiita.ac.in/iot/factory-reset.docx -

10 Dec 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-10 20:15

Updated : 2025-06-20 18:51

NVD link : CVE-2024-46340

Mitre link : CVE-2024-46340

CVE.ORG link : CVE-2024-46340

JSON object : View

Products Affected

tp-link

  • tl-wr845n
  • tl-wr845n_firmware
CWE
CWE-312

Cleartext Storage of Sensitive Information