CVE-2020-10888: (Pwn2Own) TP-Link Archer A7 SSH Port Forwarding Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during initial setup. The issue results from the lack of proper authentication prior to establishing SSH port forwarding rules. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the WAN interface.
Other sources
This vulnerability allows remote attackers to bypass authentication on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SSH port forwarding requests during initial setup. The issue results from the lack of proper authentication prior to establishing SSH port forwarding rules. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the WAN interface. Was ZDI-CAN-9664.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this TP-Link Archer A7 vulnerability?
The vulnerability ID for this TP-Link Archer A7 vulnerability is CVE-2020-10888.
What is the title of this vulnerability?
The title of this vulnerability is (Pwn2Own) TP-Link Archer A7 SSH Port Forwarding Authentication Bypass Vulnerability.
What is the severity of CVE-2020-10888?
The severity of CVE-2020-10888 is critical with a severity value of 9.8.
How can remote attackers exploit CVE-2020-10888?
Remote attackers can exploit CVE-2020-10888 by bypassing authentication on affected installations of TP-Link Archer A7 routers.
Is authentication required to exploit CVE-2020-10888?
No, authentication is not required to exploit CVE-2020-10888.