PT-2020-12396 · Tp Link · Tp-Link Archer A7

Pedro Ribeiro + 1 · Published 2020-03-25 · Updated 2023-02-16 · CVE-2020-10884

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TP-Link Archer A7 Firmware version 190726

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 routers. Authentication is not required to exploit this issue. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of a hard-coded encryption key. An attacker can leverage this in conjunction with other issues to execute code in the context of root.

Recommendations For TP-Link Archer A7 Firmware version 190726, consider disabling the tdpServer service as a temporary workaround until a patch is available. Restrict access to UDP port 20002 to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2020-10884

ZDI-20-336

Affected Products

Tp-Link Archer A7

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/tplink_archer_a7_c7_lan_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/48331 · Exploit
• 🔥 http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-10884 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-336 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10884 · Vendor Advisory
• https://t.me/cvenotify/2160 · Telegram Post