Vulnerability CVE-2017-13772

Vulnerability Name:

CVE-2017-13772 (CCN-133857)

Assigned:

2017-10-19

Published:

2017-10-19

Updated:

2020-08-31

Summary:

Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the (1) ping_addr parameter to PingIframeRpm.htm or (2) dnsserver2 parameter to WanStaticIpV6CfgRpm.htm.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.9 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.9 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.0 High (CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2017-13772

Source: MISC
Type: UNKNOWN
http://packetstormsecurity.com/files/158999/TP-Link-WDR4300-Remote-Code-Execution.html

Source: CCN
Type: Full-Disclosure Mailing List, Thu, 19 Oct 2017 22:30:21 +0100
[RCE] TP-Link Remote Code Execution CVE-2017-13772

Source: CCN
Type: TP-Link Web site
WR940N Router

Source: XF
Type: UNKNOWN
tplink-cve201713772-bo(133857)

Source: CCN
Type: Packet Storm Security [10-21-2017]
TP-Link WR940N Remote Code Execution

Source: CCN
Type: Packet Storm Security [08-28-2020]
TP-Link WDR4300 Remote Code Execution

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [10-17-2017]

Source: EXPLOIT-DB
Type: Third Party Advisory, VDB Entry
43022

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [11-5-2020]

Source: MISC
Type: Third Party Advisory
https://www.fidusinfosec.com/tp-link-remote-code-execution-cve-2017-13772/

Vulnerable Configuration:

Configuration 1:

cpe:/o:tp-link:wr940n_firmware:-:*:*:*:*:*:*:*

AND

cpe:/h:tp-link:wr940n:4:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK