CVE-2024-11237: A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of…

PriorityP276critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

5.20%

91.4th percentile

A vulnerability, which was classified as critical, has been found in TP-Link VN020 F3v(T) TT_V6.2.1021. Affected by this issue is some unknown functionality of the component DHCP DISCOVER Packet Parser. The manipulation of the argument hostname leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tp-link	vn020-f3v_firmware	—	—
tp-link	vn020_f3v	—	—

Detection & IOCsextracted from sources · hover to see the quote

versionTT_V6.2.1021↗

commandtplink_dhcp.exe↗

→Detect oversized DHCP hostname option (option 12) exceeding 64 bytes — exploit uses 127-byte hostname to overflow a 64-byte buffer ↗
→Monitor for DHCP DISCOVER packets sent to broadcast address 255.255.255.255 on UDP port 67 with malformed/oversized option fields, particularly option 12 (hostname) and corrupted length fields ↗
→Alert on DHCP service crash/no-response condition on TP-Link VN020-F3v(T) devices running firmware TT_V6.2.1021, as exploit success is indicated by service crash (no response) ↗
→Inspect DHCP DISCOVER packets for malformed vendor-specific options (option 43/125) as a tertiary attack vector alongside oversized hostname ↗
→No authentication is required; attack is unauthenticated and remotely exploitable via broadcast UDP — flag any external or LAN host sending repeated crafted DHCP DISCOVERs (up to MAX_ATTEMPTS 3) to port 67 ↗

·The exploit is a Windows-compiled PoC (cl poc.c /o tplink_dhcp.exe); detection rules targeting the compiled filename 'tplink_dhcp.exe' may help identify use of this specific PoC on attacker hosts ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

vendor_redhat5.5MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.