Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Research Advisory: Popular TP-Link Router is Vulnerable to Remote Exploitation

Tenable Research has discovered multiple vulnerabilities in the TP-Link TL-WRN841N, a popular consumer router, one of which could be used by an attacker to remotely take over the device.

  • What do you need to know? Multiple vulnerabilities in TP-Link's popular TL-WRN841N router were discovered by Tenable Research.
  • What’s the attack vector? Targeting unauthenticated users of the TL-WRN841N router’s web server.
  • What’s the business impact? An attacker can obtain full control over the router, uploading a new configuration file that will change the admin credentials as well as enable remote access to control the device remotely.
  • What’s the solution? TP-Link plans to release a patch that will address these vulnerabilities.

Background

Tenable Researcher David Wells discovered multiple vulnerabilities in the TP-Link TL-WRN841N, a popular wireless router which boasts an average rating of four stars on Amazon with more than 12,000 reviews.

Analysis

The first vulnerability in the TL-WRN841N is an improper authentication flaw, which we discovered independently during our research. It was also reported to TP-Link at the same time by a third-party researcher. It received a CVE identifier of CVE-2018-11714. This vulnerability is local, as it would allow unauthenticated attackers to trigger a set of sensitive CGI routines in the router’s admin webpage by spoofing the HTTP Referrer request from "tplinkwifi.net," "tplinklogin.net" or the router's IP address.

Our research led us to discover a second vulnerability, a cross-site request forgery (CSRF) flaw in the HTTP referrer whitelist check function in the router’s httpd service. It received a CVE identifier of CVE-2018-15702. It uses a string comparison function, strncmp, which checks to see whether or not the URL contained in the HTTP referrer field matches one of the whitelisted domains. However, this check is performed in such a way that it only looks at a certain length of characters within the string. Therefore, an attacker could craft a malicious iframe pointing to a URL with the subdomain "tplinkwifi.net" or "tplinklogin.net" (e.g. hxxp://tplinkwifi.net.drive-by-attack[.]com) and the router would consider it part of its whitelisted domains. This CSRF, combined with the improper authentication vulnerability, could allow an attacker to obtain full control over the router by uploading a malicious configuration file that would overwrite the admin credentials and even enable access to the router’s remote administration interface.

Additionally, we discovered two local/unauthenticated denial of service (DoS) vulnerabilities, both of which can cause the httpd service to crash by sending a malformed HTTP request, requiring the router to be restarted.

Proof of Concept

The researcher who discovered these has also developed a proof of concept of the CSRF vulnerability.

Solution

As of this publication, a patch for these vulnerabilities has not been released. Tenable Research has been communicating and working with TP-Link to ensure these vulnerabilities are addressed in an upcoming firmware update. Impacted end-users can contact the vendor directly for further information. We will update this blog with a link to the vendor’s patch when it is made available.

Identifying Affected Systems

Tenable has the following plugins available for identifying vulnerable assets.

Plugin ID

Description

117861

TP-Link Unauthenticated CGI Cross-Site Request Forgery (remote check)

117860

TP-Link HTTP Server Detection

Additional information:

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io Vulnerability Management

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io Vulnerability Management

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save