#VU26408 Protection Mechanism Failure in Archer A7


Published: 2020-03-26

Vulnerability identifier: #VU26408

Vulnerability risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10887

CWE-ID: CWE-693

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Archer A7
Hardware solutions / Routers for home users

Vendor: TP-Link

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures within the handling of IPv6 connections. An attacker can bypass implemented security restrictions andexecute arbitrary code on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Archer A7: 190726


External links
http://www.zerodayinitiative.com/advisories/ZDI-20-338/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability