CVE-2022-42433

6.4MEDIUM

Key Information:

Vendor
Tp-link
Status
Tl-wr841n
Vendor
CVE Published:
29 March 2023

Summary

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N TL-WR841N(US)_V14_220121 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the ated_tp service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17356.

Affected Version(s)

TL-WR841N TL-WR841N(US)_V14_220121

References

https://www.zerodayinitiative.com/advisories/ZDI-22-1466/

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cyrille Chatras
.