CVE-2024-12344

published 2024-12-08

CVE-2024-12344: A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER…

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability, which was classified as critical, was found in TP-Link VN020 F3v(T) TT_V6.2.1021. This affects an unknown part of the component FTP USER Command Handler. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
tp-link	vn020_f3v	—	—
tp-link	vn020_f3v_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

ip 192.168.1.1↗

command USER AAAA...AAAA (1450 bytes) \r\n↗

version TT_V6.2.1021↗

• → Detect oversized FTP USER commands (>=1100 bytes) sent to port 21 targeting TP-Link VN020 devices; payloads of 1100 bytes cause a delayed crash (5-10s) and 1450 bytes cause an immediate crash. ↗
• → Alert on FTP USER command payloads consisting of long repetitive byte sequences (e.g., 1450 'A' characters) sent to port 21 from unauthenticated sessions. ↗
• → Monitor for ICMP echo requests immediately following an FTP connection attempt to port 21 on the same target IP — the PoC uses ICMP ping to confirm device crash post-exploitation. ↗

• · The hardcoded target IP in the PoC (192.168.1.1) is the default gateway address for TP-Link VN020 routers; real-world attackers may target any IP where the device is reachable, so detections should not be scoped solely to this IP. ↗
• · The exploit is confirmed only against hardware version 1.0 of the VN020-F3v(T) running firmware TT_V6.2.1021; behavior on other hardware revisions or firmware versions is unconfirmed. ↗
• · Payloads exceeding 1450 bytes produce undefined behavior/state corruption rather than a clean crash, meaning the device may remain partially responsive and evade crash-based detection heuristics. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 5.3 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119 CWE-787