Google security developer Matthew Garrett discovered a zero-day arbitrary code execution (ACE) vulnerability in TP-Link SR20 routers.
The vulnerability in TP-Link SR20 routers could be exploited by potential attackers on the same network to execute arbitrary commands.
Garret immediately reported the flaw to TP-Link, but after 90 days he decided to publicly disclose the issue because the vendor did not reply to him.
“TP-Link routers frequently run a process called “
The expert explained that the TP-Link Device Debug Protocol (TDDP) allows running two types of commands on the device: type 1 which do not require authentication and type 2 which requires administrator credentials.
“The SR20 still exposes some version 1 commands, one of which (command 0x1f, request 0x01) appears to be for some sort of configuration validation,” he said. “You send it a filename, a semicolon and then an argument.”
The vulnerable router exposes several type 1 commands, including 0x1f, request 0x01 that appears to be for some sort of configuration validation. These commands could allow attackers to send a command containing a filename, a semicolon, and an argument to initiate the exploitation of the issue.
Once the router receives the command, it responds to the requesting machine via Trivial File Transfer Protocol (TFTP
Garret pointed out that the Lua
While TDDP listens on all interfaces, the default firewall implemented in the routers prevents network access.
Garrett told TP-Link it should “stop shipping debug daemons on production firmware and if you’re going to have a
The Google expert also created a proof-of-concept (PoC).
(SecurityAffairs – hacking,TP-Link SR20 Router)