Arbitrary Code Execution Vulnerability in TP-Link Router

CVE-2022-24355

Summary

This vulnerability exists in the TP-Link TL-WR940N router, allowing attackers in the network vicinity to execute arbitrary code due to insufficient validation of user-supplied data lengths when parsing file name extensions. This flaw can be exploited without authentication, enabling attackers to run malicious code with root privileges, thus compromising the device's integrity and potentially allowing further exploitation of the internal network.

References