CVE-2018-3948

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 23.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-11-30 · updated 2026-06-17
Weakness: CWE-20

Description

An exploitable denial-of-service vulnerability exists in the URI-parsing functionality of the TP-Link TL-R600VPN HTTP server. A specially crafted URL can cause the server to stop responding to requests, resulting in downtime for the management portal. An attacker can send either an unauthenticated or authenticated web request to trigger this vulnerability.

Affected products

TP-Link Tl-R600Vpn Firmware: 1.3.0, 1.2.3

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0617
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0617

Get alerted when CVE-2018-3948 or the next vulnerability affects your stack