PT-2017-13091 · Tp Link · Tp-Link Wr940N

Published 2017-10-23 · Updated 2020-08-31 · CVE-2017-13772

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions TP-Link WR940N WiFi routers with hardware version 4

Description The issue concerns multiple stack-based buffer overflows that allow remote authenticated users to execute arbitrary code. This can be achieved via the ping addr parameter to "PingIframeRpm.htm" or the dnsserver2 parameter to "WanStaticIpV6CfgRpm.htm".

Recommendations For TP-Link WR940N WiFi routers with hardware version 4, consider disabling access to "PingIframeRpm.htm" and "WanStaticIpV6CfgRpm.htm" until a patch is available. Restrict the use of the ping addr and dnsserver2 parameters in the affected API endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-13772

Affected Products

Tp-Link Wr940N

References · 5

• 🔥 https://exploit-db.com/exploits/43022 · Exploit
• 🔥 https://exploit-db.com/exploits/48994 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-13772 · Security Note
• http://packetstormsecurity.com/files/158999/TP-Link-WDR4300-Remote-Code-Execution.html · Note
• https://fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772 · Note