TP-Link Archer AX21 tmpServer Command 0x422 Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-27333

Summary

A stack-based buffer overflow vulnerability has been identified in the handling of command 0x422 by the tmpServer service in TP-Link Archer AX21 routers. This flaw allows network-adjacent attackers, who possess valid authentication credentials, to exploit the vulnerability and execute arbitrary code in the context of the root user. The failure to properly validate the length of user-supplied input leads to the overflow condition, enabling an attacker to gain control over the affected system. Organizations using TP-Link Archer AX21 devices are urged to implement appropriate security measures to mitigate potential exploits.

References