CVE-2024-54887
Published: 09 January 2025
Description
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Security Summary
CVE-2024-54887 is a buffer overflow vulnerability (CWE-120) in TP-Link TL-WR940N V3 and V4 routers running firmware version 3.16.9 and earlier. The flaw occurs in the handling of the dnsserver1 and dnsserver2 parameters on the /userRpm/Wan6to4TunnelCfgRpm.htm webpage, which can be triggered to overwrite memory boundaries.
An attacker with low privileges (PR:L) who is adjacent to the device on the network (AV:A) can exploit this with low attack complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables arbitrary code execution in the context of the root user, granting high impacts on confidentiality, integrity, and availability (CVSS:3.1 score of 8.0).
Advisories and additional details are referenced at http://tp-link.com and https://github.com/JBince/vulnerability-research/tree/main/CVE-2024-54887, which include vulnerability research and likely mitigation guidance from the vendor.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Buffer overflow vulnerability in the web management interface (/userRpm/Wan6to4TunnelCfgRpm.htm) via dnsserver parameters allows authenticated remote code execution as root, enabling Exploitation of Remote Services.