CVE-2020-35576

published 2021-01-26

CVE-2020-35576: A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute…

Priority P2 74 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
tp-link	tl-wr841n_firmware	< 201216	201216

Detection & IOCs extracted from sources · hover to see the quote

url http://192.168.0.1/cgi?2↗

url http://192.168.0.1/cgi?7↗

url http://192.168.0.1/cgi?1↗

path /cgi↗

command host="`{payload}`"↗

other [TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8↗

other [ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0↗

• → Detect POST requests to /cgi?2, /cgi?7, and /cgi?1 on TP-Link routers containing TRACEROUTE_DIAG or ACT_OP_TRACERT body strings, which are the three-stage exploit sequence for CVE-2020-35576. ↗
• → Flag HTTP POST bodies to /cgi containing backtick shell metacharacters inside the 'host=' field of a TRACEROUTE_DIAG block, e.g. host="`<cmd>`", as this is the injection vector. ↗
• → Alert on the Authorization cookie value 'Basic YWRtaW46YWRtaW4=' (base64 for admin:admin) combined with POST requests to /cgi, indicating use of default credentials in exploitation. ↗
• → The exploit uses a distinctive Gecko string with a forward-slash instead of the standard space: 'Gecko=/20100101' — this malformed User-Agent can be used as a detection signature. ↗
• → A successful first-stage exploit response returns '[error]0' as the first line; monitor for this response pattern from /cgi?2 as a confirmation of vulnerable firmware. ↗

• · The exploit targets TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 only; patched firmware (201216 and later) is not vulnerable. ↗
• · Exploitation requires authentication; the exploit uses the default admin:admin credentials (Base64: YWRtaW46YWRtaW4=). Changing default credentials raises the bar but does not patch the underlying injection flaw. ↗
• · The IOC IP address 192.168.0.1 is the router's default LAN gateway; detections based on this IP are only meaningful on internal/LAN-side traffic monitoring. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78 CWE-88