Vulnerability Detection on Tp-link Routers Allows an Attacker to

This updated guide examines Vulnerability Detection on Tp-link Routers Allows an Attacker to and organizes the essential facts, background, and practical takeaways in clear American English.

'In the case of a successful exploit, this vulnerability could allow a remote attacker to control the configuration of the router via Telnet on the local area network (LAN) and connect to the FTP server via LAN or WAN ', said security expert Grzegorz Wypych of the IBM X-Force Red team.

To exploit this security vulnerability, an attacker must send an HTTP request that contains a string longer than the number of bytes allowed, resulting in the user password being completely disabled and replaced with a value. hollow.

The built-in authentication is completely 'useless' in this case because it only checks the referrer's HTTP headers, allowing the attacker to mislead the httpd router service that this request is valid by Use hard-coded tplinkwifi.net value.

The users of these routers are mainly system administrators, who have full root access, so once the threat actors can bypass the authentication process, they will automatically gain administrative privileges. administrator on the router. After that, all processes will be run by this access holder. As such, it can be said that the attacker acted as an administrator and successfully hijacked the device.

"Attackers not only can gain high-level access, but legitimate users will also be blocked and no longer be able to log in to the internet service through the regular user interface, resulting in no unable to reset new password ', added Mr. Grzegorz Wypych.

Worse, even if the router owner sets a new password, an attacker can continue to disable it with a LAN / WAN / CGI request, causing the USB connection to the built-in FTP server to become The only way to access the router. In addition, RSA encryption keys will not be applicable in this case because they do not work with blank passwords.

This vulnerability is being monitored with the identifier CVE-2019-7405, affecting Archer C5 V4, Archer MR200v4, Archer MR6400v4 and Archer MR400v3 routers. TP-Link has released patches to help customers protect their routers from related attacks. As follows:

TP-Link routers are affected by Archer C5 V4 security patch https://static.tp-link.com/2019/201909/20190917/Archer_C5v4190815.rarArcher MR200v4https://static.tp-link.com/2019/201909/20190903/Archer%20MR200(EU)_V4_20190730.zipArcher MR6400v4https://static.tp-link.com/2019/201908/20190826/Archer%20MR6400(EU)_V4_20190730.zipArcher MR400v3https://static.tp-link.com/2019/201908/20190826/Archer % 20MR400 (EU) _V3_20190730.zip