Observable discrepancy in TP-Link WR710N
Priority MEDIUM 40CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-203.
Summary
TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00728 54th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TP-Link | WR710N | V1-151022 | — | No fix listed | CNA |
| TP-Link | Archer C5 | V2_160221_US | — | No fix listed | CNA |
- WR710N VendorTP-Link Affected V1-151022 Fixed in — No fix listed CNA
- Archer C5 VendorTP-Link Affected V2_160221_US Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:tp-link:archer_c5_firmware:2_160201_us:*:*:*:*:*:*:* | 2_160201_us | Vulnerable | TP-Link |
| cpe:2.3:h:tp-link:archer_c5:2.0:*:*:*:*:*:*:* | 2.0 | Running on | TP-Link |
| cpe:2.3:o:tp-link:tl-wr710n_firmware:1_151022_us:*:*:*:*:*:*:* | 1_151022_us | Vulnerable | TP-Link |
| cpe:2.3:h:tp-link:tl-wr710n:1.0:*:*:*:*:*:*:* | 1.0 | Running on | TP-Link |
- cpe:2.3:o:tp-link:archer_c5_firmware:2_160201_us:*:*:*:*:*:*:* Versions 2_160201_us Vulnerable ·TP-Link
- cpe:2.3:h:tp-link:archer_c5:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link
- cpe:2.3:o:tp-link:tl-wr710n_firmware:1_151022_us:*:*:*:*:*:*:* Versions 1_151022_us Vulnerable ·TP-Link
- cpe:2.3:h:tp-link:tl-wr710n:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4499
- 2026-10-03 Alias added: GHSA-q8rg-vqgg-9pmq
References
Advisory 1
More TP-Link Archer C5 Firmware vulnerabilities
- TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
- TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
- TI-2022-04112 Out-of-bounds write in TP-Link WR710N CVSS 3.1CRITICAL 9.8
- TI-2020-18081 A password-disclosure issue in the web interface on certain TP-Link devices allows a… CVSS 3.1CRITICAL 9.8
- TI-2018-13836 TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell… CVSS 3.0HIGH 7.2
Sources
- CVE-2022-4499 · CVE Program
- CVE-2022-4499 · NVD
- FIRST EPSS
- GHSA-q8rg-vqgg-9pmq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences