CVE-2022-4499 (archer_c5_firmware, tl-wr710n_firmware)

TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-channel attack. By measuring the response time of the httpd process, an attacker could guess each byte of the username and password.

attack channel credentials cve function httpd latest link measuring password process response response time routers side-channel side-channel attack software tp-link username