CVE-2020-10883

5.3MEDIUM

Key Information:

Vendor
Tp-link
Status
Archer A7
Vendor
CVE Published:
25 March 2020

Summary

This vulnerability allows local attackers to escalate privileges on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the file system. The issue lies in the lack of proper permissions set on the file system. An attacker can leverage this vulnerability to escalate privileges. Was ZDI-CAN-9651.

Affected Version(s)

Archer A7 Firmware Ver: 190726

References

https://www.zerodayinitiative.com/advisories/ZDI-20-335/
x_refsource_MISC
http://packetstormsecurity.com/files/157255/TP-Link-Arche...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro Ribeiro and Radek Domanski of Team Flashback
.