Overview
A critical vulnerability has been identified in TP-Link’s AX1800 WiFi 6 Router (Archer AX21) devices that allows unauthenticated attackers to execute arbitrary code as the root user. This vulnerability can potentially lead to a system compromise or data leakage, affecting both individual and enterprise users. It is vital that users and administrators understand this threat and apply the recommended mitigations.
Vulnerability Summary
CVE ID: CVE-2023-28760
Severity: High (CVSS: 7.5)
Attack Vector: Local Network
Privileges Required: None
User Interaction: None
Impact: Unauthorized access, arbitrary code execution, potential system compromise, and data leakage
Affected Products
Product | Affected Versions
TP-Link AX1800 WiFi 6 Router (Archer AX21) | All versions prior to the security patch
How the Exploit Works
An attacker within the same local area network (LAN) can exploit this vulnerability by sending a malicious request to the router’s `minidlnad` service. This request includes a manipulated `db_dir` field, which allows the attacker to modify `files.db`. This modification can trigger a stack-based buffer overflow in `minidlna-1.1.2/upnpsoap.c`, enabling the attacker to execute arbitrary code as root. Notably, this attack requires a USB flash drive to be connected to the router.
Conceptual Example Code
# Attackers could potentially use a shell command similar to this:
$ echo 'malicious_code' > /mnt/USB/files.dbMitigation Guidance
Users of the affected TP-Link router should immediately apply the security patch provided by the vendor. If the patch cannot be applied immediately, a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can be used as a temporary mitigation measure. Users are also advised to disconnect any USB drives from the router until the patch has been applied.
