ZDI-CAN-9662: (Pwn2Own) TP-Link Archer A7 tmpServer Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port 20002. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-9662?
The severity of ZDI-CAN-9662 is critical due to its potential for arbitrary code execution by remote attackers.
How do I fix ZDI-CAN-9662?
To fix ZDI-CAN-9662, users should update their TP-Link Archer A7 AC1750 routers to the latest firmware version provided by TP-Link.
What type of attack can be performed using ZDI-CAN-9662?
ZDI-CAN-9662 allows remote attackers to execute arbitrary code without authentication on affected TP-Link routers.
What is the impacted service in ZDI-CAN-9662?
The specific service impacted in ZDI-CAN-9662 is the tmpServer service which listens on TCP port 20002.
Which devices are affected by ZDI-CAN-9662?
ZDI-CAN-9662 affects TP-Link Archer A7 AC1750 routers specifically.