lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 19 Oct 2017 22:30:21 +0100
From: Kurtis Brown <>
Subject: [FD] [RCE] TP-Link Remote Code Execution CVE-2017-13772

** Advisory Information

Title: TP-Link Remote Code Execution
Blog URL:
Vendor: TP-Link
Date Published: 19/10/2017
CVE: CVE-2017-13772

** Vulnerability Summary

Numerous remote code execution paths were discovered in TP-Link's
WR940N home WiFi router. Valid credentials are required for this
attack path. It is possible for an authenticated attacker to obtain a
remote shell with root privileges.

** Details

There were multiple occurrences of strcpy being used in an unsafe
manner, resulting in a trivial buffer overflow condition. It is also
possible to cause a Denial of Service on the web service.

Using the ‘Diagnostic’ page, an attacker could utilise the built in
‘ping’ feature of the router to cause either; a Denial of Service
attack to crash the web server or exploit a buffer overflow condition
to obtain a remote root shell.

** Vendor Response

TP-Link have released a new version of the firmware thus mitigating
exploitation of this issue.

** Report Timeline

* Disclosed to vendor – 11/8/2017
* Response from vendor, request for initial advisory – 14/8/2017
* Initial advisory sent – 14/8/2017
* Beta patch sent for testing by vendor – 17/8/2017
* Patch confirmed to work, however other vulnerable locations were
identified, a second exploit was written to demonstrate this. Sent to
vendor – 17/8/2017
* Response by vendor, will look into the other vulnerable locations – 18/8/2017
* Second patch sent for testing by vendor – 25/8/17
* Patch confirmed to mitigate vulnerabilities (500+ calls to strcpy
removed) – 29/8/2017
* Patch released – 28/9/2017 (Only HW V5 US)

** Credit

This vulnerability was discovered by Tim Carrington, part of the Fidus
Information Security research team.

** References

** Disclaimer

This advisory is licensed under a Creative Commons Attribution Non-Commercial
Share-Alike 3.0 License:

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists