CVE-2019-6972

An issue was discovered on TP-Link TL-WR1043ND V2 devices. The credentials can be easily decoded and cracked by brute-force, WordList, or Rainbow Table attacks. Specifically, credentials in the "Authorization" cookie are encoded with URL encoding and base64, leading to easy decoding. Also, the username is cleartext, and the password is hashed with the MD5 algorithm (after decoding of the URL encoded string with base64).

• CWE-326

• https://github.com/MalFuzzer/Vulnerability-Research/blob/master/TL-WR1043ND%20V2%20-%20TP-LINK/TL-WR1043ND_PoC.pdfExploit, Third Party Advisory
• https://twitter.com/MalFuzzer/status/1141269335685652480?s=19Exploit, Third Party Advisory
• https://github.com/MalFuzzer/Vulnerability-Research/blob/master/TL-WR1043ND%20V2%20-%20TP-LINK/TL-WR1043ND_PoC.pdfExploit, Third Party Advisory
• https://twitter.com/MalFuzzer/status/1141269335685652480?s=19Exploit, Third Party Advisory

Published

Jun 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6966An issue was discovered in Bento4 1.5.1-628. The AP4_ElstAto…
• CVE-2019-6967AirTies Air5341 1.0.0.12 devices allow cgi-bin/login CSRF.
• CVE-2019-6968The web interface of the D-Link DVA-5592 20180823 is vulnera…6.1
• CVE-2019-6969The web interface of the D-Link DVA-5592 20180823 is vulnera…7.5
• CVE-2019-6970Moodle 3.5.x before 3.5.4 allows SSRF.
• CVE-2019-6971An issue was discovered on TP-Link TL-WR1043ND V2 devices. A…
• CVE-2019-6973Sricam IP CCTV cameras are vulnerable to denial of service v…
• CVE-2019-6974In the Linux kernel before 4.20.8, kvm_ioctl_create_device i…8.1
• CVE-2019-6975Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x…
• CVE-2019-6976libvips before 8.7.4 generates output images from uninitiali…
• CVE-2019-6977gdImageColorMatch in gd_color_match.c in the GD Graphics Lib…
• CVE-2019-6978The GD Graphics Library (aka LibGD) 2.2.5 has a double free …