2 lines
4.7 KiB
JSON
2 lines
4.7 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Deco M5 Deco M5 V1","vendor":"TP-Link Systems Inc.","versions":[{"lessThan":"1.9.4 Build 20260312 Rel.17129","status":"affected","version":"0","versionType":"custom"}]}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:tp-link:deco_m5_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"B01B5E35-2BC7-406C-A64A-0E6321211FF9","versionEndExcluding":"1.9.4","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:tp-link:deco_m5:1.0:*:*:*:*:*:*:*","matchCriteriaId":"17AD25A2-4196-496E-87BF-B3596F05E9A7","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks.\n\nSuccessful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality."},{"lang":"es","value":"TP-Link Deco M5 v1 utiliza un mecanismo de hash de contraseña débil para almacenar las credenciales de usuario. Un atacante que obtiene el hash de la contraseña mediante compromiso del sistema o acceso privilegiado podría realizar ataques de fuerza bruta o de diccionario.\n\nLa explotación exitosa puede resultar en la divulgación de credenciales de autenticación, lo que permite el acceso no autorizado a las funciones de gestión del dispositivo, dependiendo de los privilegios asociados con la contraseña recuperada. El principal impacto de seguridad es la pérdida de confidencialidad."}],"id":"CVE-2026-5040","lastModified":"2026-10-24T21:10:00.130","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.7,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":0.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","availabilityRequirement":"NOT_DEFINED","baseScore":7.1,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-5040","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-07-15T04:01:00.675503Z","version":"2.0.3"}}]},"published":"2026-07-14T19:18:03.213","references":[{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Product"],"url":"https://www.tp-link.com/en/support/download/deco-m5/v1/#Firmware"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Product"],"url":"https://www.tp-link.com/us/support/download/deco-m5/v1/#Firmware"},{"source":"f23511db-6c3e-4e32-a477-6aa17d310630","tags":["Vendor Advisory"],"url":"https://www.tp-link.com/us/support/faq/5190/"}],"sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-916"}],"source":"f23511db-6c3e-4e32-a477-6aa17d310630","type":"Secondary"}]}
|