TP-Link has confirmed the existence of an unpatched 0-day vulnerability affecting several router models. The company said it is already investigating the issue and preparing patches.
A zero-day vulnerability was discovered by an independent researcher known as ByteRay. The researcher notes that they first reported it to TP-Link on May 11, 2024.
The issue, which has not yet been assigned a CVE identifier, is a stack buffer overflow in TP-Link’s implementation of CWMP (CPE WAN Management Protocol) and affects an unknown number of router models.
The researcher discovered the vulnerability using automated analysis of the router’s binary files and explains that the issue lies in the function that processes SOAP SetParameterValues messages. The bug is caused by the lack of bounds checking in calls to strncpy, which enables remote code execution via a buffer overflow if the stack buffer size exceeds 3072 bytes.
According to ByteRay, in attacks this can be used to redirect vulnerable devices to a malicious CWMP server, and then deliver an excessively large SOAP payload to cause a buffer overflow.
After a compromise, an attacker can instruct the router to redirect DNS queries to malicious servers, silently intercept or manipulate unencrypted traffic, and inject malicious data into web sessions.
During testing, the researcher confirmed that the TP-Link Archer AX10 and Archer AX1500 use vulnerable CWMP binaries. He also notes that the vulnerability may be present in the EX141, Archer VR400, TD-W9970, and likely several other TP-Link devices.
TP-Link representatives told Bleeping Computer that they are currently investigating whether this vulnerability is being exploited. They report that a patch for European router models has already been created, and work is underway on firmware fixes for the U.S. and other countries. No specific patch release dates were provided.
“Our technical team is closely examining the researcher’s findings to confirm the impact criteria for devices and the conditions of exploitation, including whether CWMP is enabled by default,” the company says.