CVE-2024-57040

CRITICAL EXPLOITED

TL-WR845N - Info Disclosure

Title source: llm

Description

TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical access to the router. NOTE: The supplier has stated that this issue was fixed in firmware versions 250401 or later.

Exploits (1)

nomisec WORKING POC 2 stars

by absholi7ly · remote

https://github.com/absholi7ly/Poc-CVE-2024-57040

View Code ZIP pw:eip

References (1)

[Third Party Advisory] https://security.iiita.ac.in/iot/hashed_password.pdf

Scores

CVSS v3 9.8

EPSS 0.0916

EPSS Percentile 92.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2026-01-20

CWE

CWE-798

Status published

Products (3)

tp-link/tl-wr845n_firmware 190219

tp-link/tl-wr845n_firmware 200909

tp-link/tl-wr845n_firmware 201214

Published Feb 26, 2025

Tracked Since Feb 18, 2026