CVE-2020-10886: (Pwn2Own) TP-Link Archer A7 tmpServer Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port 20002. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port 20002. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9662.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this TP-Link Archer A7 vulnerability?
The vulnerability ID is CVE-2020-10886.
How severe is the CVE-2020-10886 vulnerability?
The severity of the CVE-2020-10886 vulnerability is critical with a CVSS score of 9.8.
What is the affected software for CVE-2020-10886?
The affected software for CVE-2020-10886 is TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers.
Is authentication required to exploit CVE-2020-10886?
No, authentication is not required to exploit CVE-2020-10886.
How can remote attackers exploit CVE-2020-10886?
Remote attackers can exploit CVE-2020-10886 by executing arbitrary code on affected installations of TP-Link Archer A7 routers.