Arbitrary Code Execution in TP-Link AC1750 Routers due to Weak Input Validation

CVE-2022-24352

Summary

A vulnerability exists in TP-Link AC1750 routers due to improper input validation in the NetUSB.ko kernel module. This flaw allows network-adjacent attackers to execute arbitrary code on affected devices without requiring authentication. The lack of proper validation can lead to a buffer overflow, allowing exploitation that grants attackers root-level access to the system. Users of these routers should apply available security updates to mitigate the risk.

References