cve-2019-13268
Vulnerability from cvelistv5
Published
2019-08-27 17:05
Modified
2024-08-04 23:49
Severity ?
Summary
TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network's subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)
References
cve@mitre.orghttps://orenlab.sise.bgu.ac.il/publications/CrossRouterExploit, Third Party Advisory
cve@mitre.orghttps://www.usenix.org/system/files/woot19-paper_ovadia.pdfThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://orenlab.sise.bgu.ac.il/publications/CrossRouterExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.usenix.org/system/files/woot19-paper_ovadia.pdfThird Party Advisory
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:49:24.300Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://orenlab.sise.bgu.ac.il/publications/CrossRouter"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.usenix.org/system/files/woot19-paper_ovadia.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network\u0027s subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-08-27T17:05:06",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://orenlab.sise.bgu.ac.il/publications/CrossRouter"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.usenix.org/system/files/woot19-paper_ovadia.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-13268",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network\u0027s subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://orenlab.sise.bgu.ac.il/publications/CrossRouter",
              "refsource": "MISC",
              "url": "https://orenlab.sise.bgu.ac.il/publications/CrossRouter"
            },
            {
              "name": "https://www.usenix.org/system/files/woot19-paper_ovadia.pdf",
              "refsource": "MISC",
              "url": "https://www.usenix.org/system/files/woot19-paper_ovadia.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-13268",
    "datePublished": "2019-08-27T17:05:06",
    "dateReserved": "2019-07-04T00:00:00",
    "dateUpdated": "2024-08-04T23:49:24.300Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:tp-link:archer_c3200_v1_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C0252646-692B-488E-9A79-B698030DF7AC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:tp-link:archer_c3200_v1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E4EE5DB-AE33-4F3E-A211-179A524F4DEA\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:tp-link:archer_c2_v1_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CECD65D5-4F10-422F-B71E-6494D56B80A2\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:tp-link:archer_c2_v1:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"10AEB762-E804-46FF-B37D-5CC21A1EFEB7\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network\u0027s subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)\"}, {\"lang\": \"es\", \"value\": \"Los dispositivos TP-Link Archer C3200 V1 y Archer C2 V1 tienen una compartimentaci\\u00f3n insuficiente entre una red host y una red de invitados establecida por el mismo dispositivo. Reenv\\u00edan las peticiones ARP, que se env\\u00edan como paquetes de broadcast, entre el host y las redes de invitados. Para utilizar esta fuga como un canal encubierto directo, el remitente puede emitir trivialmente una solicitud ARP a un equipo arbitrario de la red. (En general, algunos routers restringen el reenv\\u00edo ARP solo a las solicitudes destinadas a la m\\u00e1scara de subred de la red, pero estos enrutadores no restringieron este tr\\u00e1fico de ninguna manera. Dependiendo de este factor, uno debe utilizar los 8 bits m\\u00e1s bajos de la direcci\\u00f3n IP, o los 32 bits enteros, como la carga \\u00fatil de datos.)\"}]",
      "id": "CVE-2019-13268",
      "lastModified": "2024-11-21T04:24:35.190",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:A/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 5.8, \"accessVector\": \"ADJACENT_NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 6.5, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-08-27T18:15:10.950",
      "references": "[{\"url\": \"https://orenlab.sise.bgu.ac.il/publications/CrossRouter\", \"source\": \"cve@mitre.org\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.usenix.org/system/files/woot19-paper_ovadia.pdf\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://orenlab.sise.bgu.ac.il/publications/CrossRouter\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://www.usenix.org/system/files/woot19-paper_ovadia.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-13268\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-08-27T18:15:10.950\",\"lastModified\":\"2024-11-21T04:24:35.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. They forward ARP requests, which are sent as broadcast packets, between the host and the guest networks. To use this leakage as a direct covert channel, the sender can trivially issue an ARP request to an arbitrary computer on the network. (In general, some routers restrict ARP forwarding only to requests destined for the network\u0027s subnet mask, but these routers did not restrict this traffic in any way. Depending on this factor, one must use either the lower 8 bits of the IP address, or the entire 32 bits, as the data payload.)\"},{\"lang\":\"es\",\"value\":\"Los dispositivos TP-Link Archer C3200 V1 y Archer C2 V1 tienen una compartimentaci\u00f3n insuficiente entre una red host y una red de invitados establecida por el mismo dispositivo. Reenv\u00edan las peticiones ARP, que se env\u00edan como paquetes de broadcast, entre el host y las redes de invitados. Para utilizar esta fuga como un canal encubierto directo, el remitente puede emitir trivialmente una solicitud ARP a un equipo arbitrario de la red. (En general, algunos routers restringen el reenv\u00edo ARP solo a las solicitudes destinadas a la m\u00e1scara de subred de la red, pero estos enrutadores no restringieron este tr\u00e1fico de ninguna manera. Dependiendo de este factor, uno debe utilizar los 8 bits m\u00e1s bajos de la direcci\u00f3n IP, o los 32 bits enteros, como la carga \u00fatil de datos.)\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:A/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":5.8,\"accessVector\":\"ADJACENT_NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.5,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tp-link:archer_c3200_v1_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0252646-692B-488E-9A79-B698030DF7AC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:tp-link:archer_c3200_v1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E4EE5DB-AE33-4F3E-A211-179A524F4DEA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:tp-link:archer_c2_v1_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CECD65D5-4F10-422F-B71E-6494D56B80A2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:tp-link:archer_c2_v1:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"10AEB762-E804-46FF-B37D-5CC21A1EFEB7\"}]}]}],\"references\":[{\"url\":\"https://orenlab.sise.bgu.ac.il/publications/CrossRouter\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.usenix.org/system/files/woot19-paper_ovadia.pdf\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://orenlab.sise.bgu.ac.il/publications/CrossRouter\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://www.usenix.org/system/files/woot19-paper_ovadia.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.