CVE-2020-10884
published 2020-03-25CVE-2020-10884: This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers…
PriorityP271high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EXPLOIT
EPSS
24.50%
97.6th percentile
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tp-link | ac1750_firmware | — | — |
| tp-link | archer_a7 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for UDP traffic to port 20002 originating from LAN-side hosts targeting the router; this is the tdpServer service attack surface for CVE-2020-10884. ↗
- →Detect exploitation attempts by looking for AES-128-CBC encrypted UDP payloads using the hardcoded key 'TPONEMESH_Kf!xn?' and IV '1234567890abcdef' on port 20002. ↗
- →Command injection occurs via the 'slave_mac' field in tdpServer protocol packets; inspect decrypted UDP/20002 payloads for shell metacharacters in the slave_mac parameter. ↗
- →Fingerprint vulnerable devices by issuing an HTTP GET to /webpages/app.1564127413977.manifest on port 80; a 200 response indicates a vulnerable firmware version. ↗
- →All TP-Link Archer A7/C7 (AC1750) firmware versions up to (but excluding) releases 201029 and 201030 are exploitable; flag devices running firmware 190726 as high priority. ↗
- ·Exploitation is restricted to LAN-adjacent attackers only; the vulnerability cannot be triggered from the WAN side. ↗
- ·The hardcoded AES key and IV are used by the tdpServer service itself (not attacker-chosen), meaning any LAN host can craft valid encrypted packets without credentials. ↗
- ·A patch bypass was discovered in November 2020; the updated injection technique works on older firmware too, so patching to firmware 190726 alone is insufficient. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.1HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:A/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
exploitdb·2020-04-16
CVE-2020-10884 TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'openssl'
class MetasploitModule 'TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution',
'Description' => %q{
This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on
the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726.
The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does
not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command
as root, incl
Metasploit
TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
metasploit
TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution
This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attacker on the LAN side of the router, but the attacker does not need any authentication to abuse it. After exploitation, an attacker will be able to execute any command as root, including downloading and executing a binary from another host. This vulnerability was discovered and exploited at Pwn2Own Tokyo 2019 by the Flashback team (Pedro Ribeiro + Radek Domanski). This module was updated in November 2020, after a bypass was discovered for the patch TP-Link issued.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-20-336/http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.htmlhttps://www.zerodayinitiative.com/advisories/ZDI-20-336/
2020-03-25
Published