Vendors / TP-Link Records 637 All Threatist records
Exploited (KEV) 6
CVSS critical 100
CVSS high 356
Exploited now TP-Link records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 46
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01794 · Published 2017-04-23 · No fix listed CWE-532
Priority MEDIUM 46
On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01941 · Published 2017-04-23 · No fix listed CWE-532
Priority MEDIUM 44
On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.009 · Published 2017-04-23 · No fix listed CWE-326
Priority LOW 35
On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt).
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01106 · Published 2017-04-23 · No fix listed CWE-798
Priority LOW 34
Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials.
CVSS 3.0 MEDIUM 6.8· Adjacent network · High privileges · No interaction · EPSS 0.02039 · Published 2017-12-20 · No fix listed CWE-306
Priority LOW 30
Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition.
CVSS 3.0 MEDIUM 6.5· Adjacent network · No auth · No interaction · EPSS 0.00716 · Published 2017-12-20 · No fix listed CWE-306
Priority LOW 29
A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel.
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00695 · Published 2025-01-27 · No fix listed CWE-598
Priority LOW 28
On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd).
CVSS 3.0 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01859 · Published 2017-04-23 · No fix listed CWE-287
Priority LOW 25
Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter.
CVSS 3.0 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00593 · Published 2017-12-20 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
100 356 178 3 0
THREATIST.IORead the docs