CVE-2020-10882
published 2020-03-25CVE-2020-10882: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750…
PriorityP276high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EXPLOIT
EPSS
44.44%
98.6th percentile
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tp-link | ac1750_firmware | < 201029 | 201029 |
| tp-link | ac1750_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for UDP traffic to port 20002 on TP-Link Archer A7/C7 devices; unauthenticated exploitation does not require prior authentication, so any external/LAN source sending crafted packets to this port is suspicious. ↗
- →The exploit injects commands via the 'slave_mac' parameter in tdpServer packets; look for anomalous or shell-metacharacter-containing values in that field. ↗
- →Exploit payloads are AES-128-CBC encrypted with hardcoded key 'TPONEMESH_Kf!xn?' and IV '1234567890abcdef'; network signatures can match this static key material in UDP/20002 traffic. ↗
- →HTTP GET to '/webpages/app.1564127413977.manifest' on port 80 is used by the Metasploit module as a version check fingerprint for vulnerable firmware 190726. ↗
- →All firmware versions up to (but excluding) 201029 and 201030 are exploitable; detect devices running firmware version 190726 as a high-priority finding. ↗
- ·Exploitation is limited to attackers on the LAN side of the router; this is not remotely exploitable from the WAN. ↗
- ·A patch bypass was discovered in November 2020; the updated injection technique works on older firmware too, meaning the original TP-Link patch was insufficient. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.08.3HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-264q-ch9j-7v9c: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1
ghsa_unreviewed·2022-05-24
CVE-2020-10882 [HIGH] CWE-78 GHSA-264q-ch9j-7v9c: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.
GHSA
GHSA-3685-2v7g-3c6v: tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter
ghsa_unreviewed·2022-05-24·CVSS 8.8
CVE-2020-28347 [HIGH] CWE-77 GHSA-3685-2v7g-3c6v: tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter
tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled.
No detection rules found.
Exploit-DB
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
exploitdb·2020-04-16
CVE-2020-10884 TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'openssl'
class MetasploitModule 'TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution',
'Description' => %q{
This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on
the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726.
The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does
not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command
as root, incl
Metasploit
TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
metasploit
TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command as root, including downloading and executing a binary from another host. This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro + Radek Domanski). This module was updated in November 2020, after a bypass was discovered for the patch TP-Link issued.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-20-334/http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-20-334/
2020-03-25
Published