A vulnerable HTTP Basic Authentication process in TP-Link routers, Archer C5 and WR710N-V1, is susceptible to either a DoS or an arbitrary code execution via any interface.

CVE-2022-4498

Summary

The vulnerability in TP-Link routers, specifically the Archer C5 and WR710N-V1 models, allows for a heap overflow through crafted packets sent during HTTP Basic Authentication. This flaw can lead to a denial of service by crashing the httpd service or facilitate arbitrary code execution, jeopardizing the security and functionality of the affected devices. It is crucial for users to apply mitigations and updates to safeguard against potential exploitation.

References