Insufficient Network Segregation in TP-Link Archer Devices

CVE-2019-13267

Summary

The TP-Link Archer C3200 V1 and Archer C2 V1 devices exhibit insufficient compartmentalization between host and guest networks established on the same device. This vulnerability allows attackers to exploit the IGMP protocol to facilitate unauthorized data transfers from the host network to the guest network. When a device leaves an IGMP group, it triggers the router to generate an IGMP Membership Query, which is sent to both networks, thus potentially exposing sensitive data via the Group IP field manipulated by the sender.

References