PT-2020-17050 · Tp Link · Tp-Link Wdr Series

Published 2020-11-20 · Updated 2020-12-09 · CVE-2020-28877

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TP-Link WR and WDR series versions (including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR882N, and WR708N)

Description The issue is a buffer overflow in the copy msg element function for the devDiscoverHandle server. This affects the TP-Link WR and WDR series, including various models such as WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR882N, and WR708N. The copy msg element function is vulnerable, and the devDiscoverHandle server is the affected component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2020-28877

Affected Products

Tp-Link Wdr Series

References · 7

• 🔥❌ https://github.com/peanuts62/TP-Link-poc · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2020-28877 · Security Note
• https://t.me/cvenotify/6534 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/192112 · Note
• https://t.me/cvenotify/5941 · Telegram Post
• https://t.me/cibsecurity/17411 · Telegram Post
• https://t.me/cibsecurity/16665 · Telegram Post