Firewall Bypass in TP-Link Archer A7 Router Firmware
CVE-2020-10887

8.1HIGH

Key Information:

Vendor
Tp-link
Status
Archer A7
Vendor
CVE Published:
25 March 2020

Summary

A vulnerability has been identified in TP-Link Archer A7 routers running firmware version 190726 AC1750, allowing an attacker to bypass firewall protections through unfiltered IPv6 SSH connections. This flaw can be exploited without authentication, potentially enabling an attacker to leverage existing vulnerabilities to execute arbitrary code with root privileges. This significant security risk emphasizes the need for users to update their firmware and secure their network against unauthorized access.

Affected Version(s)

Archer A7 Firmware Ver: 190726

References

https://www.zerodayinitiative.com/advisories/ZDI-20-338/
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

F-Secure Labs - Mark Barnes, Toby Drew, Max Van Amerongen, and James Loureiro
.