CVE-2020-10884: (Pwn2Own) TP-Link Archer A7 tdpServer Use of Hard-coded Cryptographic Key Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.
Other sources
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10884?
CVE-2020-10884 is a vulnerability that allows network-adjacent attackers to execute arbitrary code on TP-Link Archer A7 routers.
How severe is CVE-2020-10884?
CVE-2020-10884 has a severity score of 8.8, which is considered high.
How does CVE-2020-10884 work?
CVE-2020-10884 exploits a flaw in the tdpServer service of TP-Link Archer A7 routers, allowing attackers to execute code without authentication.
Is authentication required to exploit CVE-2020-10884?
No, authentication is not required to exploit CVE-2020-10884.
How can I fix CVE-2020-10884?
To fix CVE-2020-10884, it is recommended to update the firmware of the TP-Link Archer A7 router to a version that addresses the vulnerability.