Cyber Posture

CVE-2024-54887

High

Published: 09 January 2025

Published
09 January 2025
Modified
20 June 2025
KEV Added
Patch
CVSS Score 8.0 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0173 82.5th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2024-54887 is a buffer overflow vulnerability (CWE-120) in TP-Link TL-WR940N V3 and V4 routers running firmware version 3.16.9 and earlier. The flaw occurs in the handling of the dnsserver1 and dnsserver2 parameters on the /userRpm/Wan6to4TunnelCfgRpm.htm webpage, which can be triggered to overwrite memory boundaries.

An attacker with low privileges (PR:L) who is adjacent to the device on the network (AV:A) can exploit this with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables arbitrary code execution in the context of the root user, granting high impacts on confidentiality, integrity, and availability (CVSS:3.1 score of 8.0).

Advisories and additional details are referenced at http://tp-link.com and https://github.com/JBince/vulnerability-research/tree/main/CVE-2024-54887, which include vulnerability research and likely mitigation guidance from the vendor.

Details

CWE(s)
CWE-120

Affected Products

tp-link
tl-wr940n firmware
≤ 3.16.9

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Why these techniques?

Buffer overflow vulnerability in the web management interface (/userRpm/Wan6to4TunnelCfgRpm.htm) via dnsserver parameters allows authenticated remote code execution as root, enabling Exploitation of Remote Services.

References