CVE-2019-19143

MEDIUM

TP-LINK TL-WR849N 0.9.1 4.16 - Unauthenticated Firmware Replacement via cgi/softup POST Request

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2019-19143. PoCs published by Elber Tavares.

AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in TP-Link TL-WR849N firmware version 0.9.1 4.16, allowing unauthenticated firmware upload via a crafted POST request to the `/cgi/confup` endpoint. The PoC uses `curl` to send a multipart form data request with a firmware file (`conf.bin`) to the target device.

Description

TP-LINK TL-WR849N 0.9.1 4.16 devices do not require authentication to replace the firmware via a POST request to the cgi/softup URI.

Exploits (1)

exploitdb WORKING POC
by Elber Tavares · textwebappshardware
https://www.exploit-db.com/exploits/48152

This exploit demonstrates an authentication bypass vulnerability in TP-Link TL-WR849N firmware version 0.9.1 4.16, allowing unauthenticated firmware upload via a crafted POST request to the `/cgi/confup` endpoint. The PoC uses `curl` to send a multipart form data request with a firmware file (`conf.bin`) to the target device.

Classification
Working Poc 90%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: TP-Link TL-WR849N 0.9.1 4.16
No auth needed
Prerequisites: Network access to the target device · A firmware file (`conf.bin`) to upload
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://fireshellsecurity.team/hack-n-routers/

Scores

CVSS v3 6.1
EPSS 0.0379
EPSS Percentile 88.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-306
Status published
Products (1)
tp-link/tl-wr849n_firmware 0.9.1_4.16
Published Jan 27, 2020
Tracked Since Feb 18, 2026