[FD] [RCE] TP-Link Remote Code Execution CVE-2017-13772

** Advisory Information Title: TP-Link Remote Code Execution Blog URL: http://ift.tt/2yCaPRM Vendor: TP-Link Date Published: 19/10/2017 CVE: CVE-2017-13772 ** Vulnerability Summary Numerous remote code execution paths were discovered in TP-Link's WR940N home WiFi router. Valid credentials are required for this attack path. It is possible for an authenticated attacker to obtain a remote shell with root privileges. ** Details There were multiple occurrences of strcpy being used in an unsafe manner, resulting in a trivial buffer overflow condition. It is also possible to cause a Denial of Service on the web service. Using the ‘Diagnostic’ page, an attacker could utilise the built in ‘ping’ feature of the router to cause either; a Denial of Service attack to crash the web server or exploit a buffer overflow condition to obtain a remote root shell. ** Vendor Response TP-Link have released a new version of the firmware thus mitigating exploitation of this issue. ** Report Timeline * Disclosed to vendor – 11/8/2017 * Response from vendor, request for initial advisory – 14/8/2017 * Initial advisory sent – 14/8/2017 * Beta patch sent for testing by vendor – 17/8/2017 * Patch confirmed to work, however other vulnerable locations were identified, a second exploit was written to demonstrate this. Sent to vendor – 17/8/2017 * Response by vendor, will look into the other vulnerable locations – 18/8/2017 * Second patch sent for testing by vendor – 25/8/17 * Patch confirmed to mitigate vulnerabilities (500+ calls to strcpy removed) – 29/8/2017 * Patch released – 28/9/2017 (Only HW V5 US) ** Credit This vulnerability was discovered by Tim Carrington, part of the Fidus Information Security research team. ** References http://ift.tt/2yCaPRM ** Disclaimer This advisory is licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 License: http://ift.tt/e9zF8v

Source: Gmail -> IFTTT-> Blogger