PT-2023-4517 · Tp Link · Tp-Link Tl-Wr940N+2
Published
2023-08-07
·
Updated
2023-08-25
·
CVE-2023-39747
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
TP-Link TL-WR940N version V2
TP-Link TL-WR941ND version V5
TP-Link WR841N version V8
Description
The issue is related to buffer overflow errors in the /userRpm/WlanSecurityRpm component of TP-Link router microprogram software. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability can be exploited via the
radiusSecret parameter at the "/userRpm/WlanSecurityRpm" API endpoint.Recommendations
For TP-Link TL-WR940N version V2, update to a version that fixes the buffer overflow issue in the /userRpm/WlanSecurityRpm component.
For TP-Link TL-WR941ND version V5, update to a version that fixes the buffer overflow issue in the /userRpm/WlanSecurityRpm component.
For TP-Link WR841N version V8, update to a version that fixes the buffer overflow issue in the /userRpm/WlanSecurityRpm component.
As a temporary workaround, consider restricting access to the "/userRpm/WlanSecurityRpm" API endpoint and avoiding the use of the
radiusSecret parameter until a patch is available.Exploit
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tp-Link Tl-Wr940N
Tp-Link Tl-Wr941Nd
Tp-Link Wr841N