PT-2021-6137 · Tp Link · Tp-Link Ac1750
0Vercl0K
+1
·
Published
2021-12-01
·
Updated
2022-02-28
·
CVE-2022-24354
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TP-Link AC1750 versions prior to 1.1.4 Build 20211022 rel.59103(5553)
Description
This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 routers. Authentication is not required to exploit this issue. The specific flaw exists within the
NetUSB.ko module, resulting from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this issue to execute code in the context of root.Recommendations
For versions prior to 1.1.4 Build 20211022 rel.59103(5553), consider updating to a version that includes the fix for this issue. As a temporary workaround, consider disabling the
NetUSB.ko module until a patch is available. Restrict access to the router to minimize the risk of exploitation.Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tp-Link Ac1750