CVE-2020-10884: (Pwn2Own) TP-Link Archer A7 tdpServer Use of Hard-coded Cryptographic Key Remote Code Execution Vulnerability
First published: Wed Mar 25 2020(Updated: )
This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TP-Link Archer A7 | ||
| Tp-link Ac1750 Firmware | =190726 | |
| TP-Link AC1750 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-10884?
CVE-2020-10884 is a vulnerability that allows network-adjacent attackers to execute arbitrary code on TP-Link Archer A7 routers.
How severe is CVE-2020-10884?
CVE-2020-10884 has a severity score of 8.8, which is considered high.
How does CVE-2020-10884 work?
CVE-2020-10884 exploits a flaw in the tdpServer service of TP-Link Archer A7 routers, allowing attackers to execute code without authentication.
Is authentication required to exploit CVE-2020-10884?
No, authentication is not required to exploit CVE-2020-10884.
How can I fix CVE-2020-10884?
To fix CVE-2020-10884, it is recommended to update the firmware of the TP-Link Archer A7 router to a version that addresses the vulnerability.
- collector/zdi-advisory
- alias/ZDI-20-336
- alias/ZDI-CAN-9652
- alias/CVE-2020-10884
- collector/nvd-index
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/title
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/tp-link
- canonical/tp-link archer a7
- canonical/tp-link ac1750 firmware
- version/tp-link ac1750 firmware/190726
- canonical/tp-link ac1750