CVE-2022-4499 describes a side-channel vulnerability in TP-Link Archer C5 and WR710N-V1 routers, allowing attackers to guess login credentials by measuring HTTP response times during authentication. This high-severity vulnerability (CVSS 7.5) has a low attack complexity and requires no user interaction, potentially leading to unauthorized access to the device. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness among security researchers. It is not listed in CISA's KEV catalog, and its EPSS score is very low, suggesting a low probability of exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2_160201_usCPE matchmatch criteria | cpe:2.3:o:tp-link:archer_c5_firmware:2_160201_us:*:*:*:*:*:*:* | ||
1_151022_usCPE matchmatch criteria | cpe:2.3:o:tp-link:tl-wr710n_firmware:1_151022_us:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.