PT-2022-2170 · Tp Link · Tp-Link Tl-Wr840N

Published 2022-02-14 · Updated 2022-03-09 · CVE-2022-25062

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR840N(ES) version V6.20 180709

Description The issue is related to an integer overflow in the dm checkString() function of the libcmm.so module in the TP-Link TL-WR840N(ES) router's firmware. This can be exploited by sending a crafted HTTP request, potentially allowing an attacker to cause a Denial of Service (DoS). The dm checkString() function is vulnerable to integer overflow, which can be triggered via a specially crafted HTTP request.

Recommendations For TP-Link TL-WR840N(ES) version V6.20 180709, consider disabling the dm checkString() function as a temporary workaround until a patch is available. Restrict access to the vulnerable module libcmm.so to minimize the risk of exploitation. Avoid using the vulnerable function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2022-02181

CVE-2022-25062

Affected Products

Tp-Link Tl-Wr840N

References · 10

• https://bdu.fstec.ru/vul/2022-02181 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25062 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25062 · Vendor Advisory
• http://tp-link.com · Note
• https://t.me/cvenotify/27936 · Telegram Post
• http://router.com · Note
• https://t.me/cvenotify/27401 · Telegram Post
• https://vuldb.com/ru/?id.193843 · Note
• https://t.me/cibsecurity/38133 · Telegram Post
• https://east-trowel-102.notion.site/CVE-2021-XXXX-RCE-Integer-Overflow-via-crafted-payload-in-an-DNS-input-field-userDomain-EN-2bc0fafd23224a5a8f86f5f0f9377d3d · Note