bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

TP-Link: smuggling malicious code through a security hole in routers

Summary

In 2022 researchers from the Vietnamese telecommunications group Viettel found a buffer overflow in the web-based ping tool of the low-cost TP-Link TL-WR841N Wi-Fi router (CVE-2022-30024). Logged-in attackers could execute their own code via an overlong host address and, for example, install a backdoor. TP-Link delivered updates for revisions V10 to V12 and declared older devices end-of-life.

Ideas

  • Diagnostic tools in the web interface are a common entry point for code execution.
  • Overlong input overflows the firmware’s internal buffers.
  • The required login lowers the risk but does not prevent botnet combinations.
  • Older hardware revisions of the same model received no fix.

Insights

  • With routers, the same model name says little about support status; the revision is what matters.
  • Cheap mass-market routers are attractive botnet building blocks because they are so widespread.

Facts

  • The hole has a CVSS score of 8.8.
  • Fixed firmware appeared as V10_200325, V11_211209 and V12_220802.

References

Critique

  • The report does not say whether default passwords make the required login trivial in practice.

Recommendations

  • Check the hardware revision on the type plate before searching for firmware updates.
  • Replace routers whose revision no longer receives security updates, or install OpenWrt.

Read the original article

Search the Web Archive

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.

hß · 2014

TR-069 remote maintenance hole in DSL routers: German internet providers call their networks secure

After Shahar Tal’s DEF CON talk about holes in TR-069 remote maintenance servers, heise asked German providers in 2014 how they were protected. Telekom, Vodafone, 1&1 and others considered their networks secure because their routers reject self-signed certificates or only contact preset servers. Tal had shown that a hijacked Auto Configuration Server can redirect or read out thousands of routers.

hß · 2014

AVM routers: another hole in the FritzBox remote maintenance function

In 2014 heise Security found a hole in the MyFritz apps for Android and iOS through which attackers could access a FritzBox’s web interface without a password. The apps did not check the box’s SSL certificate sufficiently, so an attacker on someone else’s network could grab the session ID. AVM solved this with certificate pinning: the apps remember the certificate’s fingerprint on first contact and warn if it changes.