CVE-2024-46340

After performing a factory reset to default settings, the device transmits user authentication data (e.g., passwords) in plaintext over the network without any encryption. An attacker capable of monitoring network traffic in the same network segment or on the transmission path can intercept this data without any additional privileges or user interaction. This is inconsistent with security best practices classified as CWE-312 (storage/transmission of sensitive data in unencrypted form).

An attacker can intercept user authentication data (login and password), which consequently allows for taking full administrative control over the device and potentially over the local network behind it.

Apply patches available from the manufacturer according to the references. Temporarily, it is recommended to avoid performing factory reset of the device in untrusted network environments and to monitor network traffic for transmission of authentication data in plaintext.

TP-Link TL-WR845N(UN) firmware versions: V4_201214, V4_200909, and V4_190219