Show vulnerabilities with patch / with exploit

Multiple vulnerabilities in TP-Link Archer A7



Published: 2020-03-26
Severity High
Patch available YES
Number of vulnerabilities 8
CVE ID CVE-2020-10888
CVE-2020-10886
CVE-2020-10887
CVE-2020-10885
CVE-2020-10884
CVE-2020-10883
CVE-2020-10882
CVE-2020-10881
CWE ID CWE-287
CWE-77
CWE-693
CWE-20
CWE-321
CWE-264
CWE-121
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Archer A7
Hardware solutions / Routers for home users

Vendor TP-Link

Security Advisory

1) Improper Authentication

Severity: Medium

CVSSv3: 5.2 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10888

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to a lack of proper authentication prior to establishing SSH port forwarding rules during initial setup. A remote attacker can bypass authentication process and gain elevated privileges to resources normally protected from the WAN interface.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-340/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command Injection

Severity: High

CVSSv3: 7.1 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10886

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists within the "tmpServer" service due to a lack of proper validation of a user-supplied string before using it to execute a system call. A remote attacker can execute arbitrary commands on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-339/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Protection Mechanism Failure

Severity: High

CVSSv3: 7.1 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10887

CWE-ID: CWE-693 - Protection Mechanism Failure

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures within the handling of IPv6 connections. An attacker can bypass implemented security restrictions andexecute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-338/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

Severity: High

CVSSv3: 7.1 [CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10885

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input when handling the DNS responses. A remote attacker can pass a specially crafted input to the application and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-337/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use of Hard-coded Cryptographic Key

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10884

CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key

Exploit availability: No

Description

The vulnerability allows a remote attacker to disclose sensitive information on the target system.

The vulnerability exists within the "tdpServer" service due to the affected system uses a hard-coded cryptographic key. A remote attacker on the local network can identify cryptographic keys.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-336/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Permissions, Privileges, and Access Controls

Severity: Low

CVSSv3: 4.6 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10883

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a lack of proper permissions set on the file system. A local user can gain elevated privileges on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-335/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Command Injection

Severity: Low

CVSSv3: 7.7 [CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10882

CWE-ID: CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists within the "tdpServer" service due to the process does not properly validate a user-supplied string before using it to execute a system call when parsing the "slave_mac" parameter. A remote attacker on the local network can execute arbitrary commands on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-334/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stack-based buffer overflow

Severity: High

CVSSv3: 8.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-10881

CWE-ID: CWE-121 - Stack-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling the DNS responses. A remote unauthenticated attacker can send a specially crafted DNS message, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726

CPE External links

https://www.zerodayinitiative.com/advisories/ZDI-20-333/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.