Test ID:	1.3.6.1.4.1.25623.1.0.803752
Category:	Web application abuses
Title:	TP-Link TD-W8951ND XSS and CSRF Vulnerabilities
Summary:	TP-Link TD-W8951ND is prone to cross-site scripting (XSS) and; cross-site request forgery (CSRF) vulnerabilities.
Description:	Summary: TP-Link TD-W8951ND is prone to cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities. Vulnerability Insight: Multiple flaws are due to: - Input passed to the 'Referer' header in HTTP request is not properly sanitised before being returned to the user. - Input passed to the 'wlanWEBFlag', 'AccessFlag', 'wlan_APenable' parameter in '/Forms/home_wlan_1' is not properly sanitised before being returned to the user. - Input passed to the 'PingIPAddr' parameter in '/Forms/tools_test_1' is not properly sanitised before being returned to the user. Vulnerability Impact: Successful exploitation will allow attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Affected Software/OS: TP-Link TD-W8951ND Firmware 4.0.0 Build 120607, Other versions may also be affected. Solution: Firmware update is available. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.