Full Disclosure mailing list archives
[RCE] TP-Link Remote Code Execution CVE-2017-13772
From: Kurtis Brown <kurtis () kurtisebear com>
Date: Thu, 19 Oct 2017 22:30:21 +0100
** Advisory Information Title: TP-Link Remote Code Execution Blog URL: https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/ Vendor: TP-Link Date Published: 19/10/2017 CVE: CVE-2017-13772 ** Vulnerability Summary Numerous remote code execution paths were discovered in TP-Link's WR940N home WiFi router. Valid credentials are required for this attack path. It is possible for an authenticated attacker to obtain a remote shell with root privileges. ** Details There were multiple occurrences of strcpy being used in an unsafe manner, resulting in a trivial buffer overflow condition. It is also possible to cause a Denial of Service on the web service. Using the ‘Diagnostic’ page, an attacker could utilise the built in ‘ping’ feature of the router to cause either; a Denial of Service attack to crash the web server or exploit a buffer overflow condition to obtain a remote root shell. ** Vendor Response TP-Link have released a new version of the firmware thus mitigating exploitation of this issue. ** Report Timeline * Disclosed to vendor – 11/8/2017 * Response from vendor, request for initial advisory – 14/8/2017 * Initial advisory sent – 14/8/2017 * Beta patch sent for testing by vendor – 17/8/2017 * Patch confirmed to work, however other vulnerable locations were identified, a second exploit was written to demonstrate this. Sent to vendor – 17/8/2017 * Response by vendor, will look into the other vulnerable locations – 18/8/2017 * Second patch sent for testing by vendor – 25/8/17 * Patch confirmed to mitigate vulnerabilities (500+ calls to strcpy removed) – 29/8/2017 * Patch released – 28/9/2017 (Only HW V5 US) ** Credit This vulnerability was discovered by Tim Carrington, part of the Fidus Information Security research team. ** References https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/ ** Disclaimer This advisory is licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- [RCE] TP-Link Remote Code Execution CVE-2017-13772 Kurtis Brown (Oct 20)