CVE-2017-8077

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firmware.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/Exploit, Technical Description, Third Party Advisory
https://chmod750.com/2017/04/23/vulnerability-disclosure-tp-link/Exploit, Technical Description, Third Party Advisory

Timeline

Published: Apr 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-80785.3On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd)CVE-2017-80808.8Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors inv CVE-2017-80818.8Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate pri CVE-2017-80826.5concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely CVE-2017-80836.7CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of f CVE-2017-80856.1In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.CVE-2017-80866.5Memory leak in the v9fs_list_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cau CVE-2017-80872.4Information Leakage in PPPoE Packet Padding in AVM Fritz!Box 7490 with Firmware versions Fritz!OS 6.80 and 6.83 allows physically proximate CVE-2017-80986.5e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can CVE-2017-80998.1There is CSRF in the WHIZZ plugin before 1.1.1 for WordPress, allowing attackers to delete any WordPress users and change the plugin's statu CVE-2017-81006.5There is CSRF in the CopySafe Web Protection plugin before 2.6 for WordPress, allowing attackers to change plugin settings.CVE-2017-81018.8There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request.