PT-2021-17352 · Tp Link · Tp-Link Archer A7 Ac1750

0Xmitsurugi + 1 · Published 2021-02-24 · Updated 2021-04-22 · CVE-2021-27246

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TP-Link Archer A7 AC1750 version 1.0.15

Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists within the handling of MAC addresses by the "tdpServer" endpoint. A crafted TCP message can write stack pointers to the stack. An attacker can leverage this issue to execute code in the context of the root user.

Recommendations: For TP-Link Archer A7 AC1750 version 1.0.15, as a temporary workaround, consider restricting access to the tdpServer endpoint until a patch is available. Avoid using crafted TCP messages that can write stack pointers to the stack. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2021-27246

ZDI-21-215

Affected Products

Tp-Link Archer A7 Ac1750

References · 5

• 🔥 https://github.com/synacktiv/CVE-2021-27246_Pwn2Own2020 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-21-215 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27246 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27246 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2882 · Telegram Post