TP-Link Tl-SG108E Firmware vulnerabilities

9 CVEs affecting TP-Link Tl-SG108E Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0730, published 2025-01-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-17746, published 2017-12-20. Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days. Weak access control methods on the TP-Link TL-SG108E 1.0.0 allow any user on a NAT network with an authenticated administrator to access the device without entering user credentials. The…
CVE-2017-8074, published 2017-04-23. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749…
CVE-2017-8078, published 2017-04-23. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd). This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
CVE-2017-8075, published 2017-04-23. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
CVE-2017-8077, published 2017-04-23. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
CVE-2017-8076, published 2017-04-23. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.
CVE-2017-17747, published 2017-12-20. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Weak access controls in the Device Logout functionality on the TP-Link TL-SG108E v1.0.0 allow remote attackers to call the logout functionality, triggering a denial of service condition.
CVE-2025-0730, published 2025-01-27. Low severity, CVSS 3.7. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown function of the file /usr_account_set.cgi of the component HTTP…
CVE-2017-17745, published 2017-12-20. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in system_name_set.cgi in TP-Link TL-SG108E 1.0.0 allows authenticated remote attackers to submit arbitrary java script via the 'sysName' parameter.