SB2020032623 - Multiple vulnerabilities in TP-Link Archer A7
Published: March 26, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Improper Authentication (CVE-ID: CVE-2020-10888)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to a lack of proper authentication prior to establishing SSH port forwarding rules during initial setup. A remote attacker can bypass authentication process and gain elevated privileges to resources normally protected from the WAN interface.
2) Command Injection (CVE-ID: CVE-2020-10886)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists within the "tmpServer" service due to a lack of proper validation of a user-supplied string before using it to execute a system call. A remote attacker can execute arbitrary commands on the system.
3) Protection Mechanism Failure (CVE-ID: CVE-2020-10887)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures within the handling of IPv6 connections. An attacker can bypass implemented security restrictions andexecute arbitrary code on the system.
4) Input validation error (CVE-ID: CVE-2020-10885)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input when handling the DNS responses. A remote attacker can pass a specially crafted input to the application and execute arbitrary code on the system.
5) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2020-10884)
The vulnerability allows a remote attacker to disclose sensitive information on the target system.
The vulnerability exists within the "tdpServer" service due to the affected system uses a hard-coded cryptographic key. A remote attacker on the local network can identify cryptographic keys.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-10883)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a lack of proper permissions set on the file system. A local user can gain elevated privileges on the target system.
7) Command Injection (CVE-ID: CVE-2020-10882)
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists within the "tdpServer" service due to the process does not properly validate a user-supplied string before using it to execute a system call when parsing the "slave_mac" parameter. A remote attacker on the local network can execute arbitrary commands on the system.
8) Stack-based buffer overflow (CVE-ID: CVE-2020-10881)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when handling the DNS responses. A remote unauthenticated attacker can send a specially crafted DNS message, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Install update from vendor's website.
References
- https://www.zerodayinitiative.com/advisories/ZDI-20-340/
- https://www.zerodayinitiative.com/advisories/ZDI-20-339/
- https://www.zerodayinitiative.com/advisories/ZDI-20-338/
- https://www.zerodayinitiative.com/advisories/ZDI-20-337/
- https://www.zerodayinitiative.com/advisories/ZDI-20-336/
- https://www.zerodayinitiative.com/advisories/ZDI-20-335/
- https://www.zerodayinitiative.com/advisories/ZDI-20-334/
- https://www.zerodayinitiative.com/advisories/ZDI-20-333/