What is the CVSS score of CVE-2020-11445?

CVE-2020-11445 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 1.8%.

Tapo C200 Firmware CVE-2020-11445

MEDIUM

2020-04-01 cve@mitre.org

Information Disclosure TP-Link Tapo C200 Firmware Nc250 Firmware Nc450 Firmware Nc260 Firmware Nc230 Firmware Nc220 Firmware Nc210 Firmware Nc200 Firmware Kc300S2 Firmware Kc310S2 Firmware Kc200 Firmware Tapo C100 Firmware Tl Sc3430 Firmware Tl Sc3430N Firmware Tl Sc4171G Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 01, 2020 - 04:15 nvd

MEDIUM 5.3

DescriptionNVD

TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled, aka CNVD-2020-04855.

AnalysisAI

TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled, aka CNVD-2020-04855. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session with GPS enabled, aka CNVD-2020-04855. Affected products include: Tp-Link Nc450 Firmware, Tp-Link Nc260 Firmware, Tp-Link Nc250 Firmware, Tp-Link Nc230 Firmware, Tp-Link Nc220 Firmware. Version information: through 2020.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.