Vulnerability Name:

CVE-2021-27245 (CCN-197380)

Assigned:2021-02-24
Published:2021-02-24
Updated:2021-04-01
Summary:This vulnerability allows a firewall bypass on affected installations of TP-Link Archer A7 prior to Archer C7(US)_V5_210125 and Archer A7(US)_V5_200220 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of IPv6 connections. The issue results from the lack of proper filtering of IPv6 SSH connections. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-12309.
CVSS v3 Severity:8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
7.6 High (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-693
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2021-27245

Source: XF
Type: UNKNOWN
tplink-cve202127245-code-exec(197380)

Source: CCN
Type: TP-Link
TP-Link Archer A7 AC1750 routers

Source: CCN
Type: ZDI-21-214
TP-Link Archer A7 Protection Mechanism Failure Firewall Bypass Vulnerability

Source: N/A
Type: Third Party Advisory, VDB Entry
N/A

Vulnerable Configuration:Configuration 1:
  • cpe:/o:tp-link:archer_a7_firmware:*:*:*:*:*:*:*:* (Version < c7(us)_v5_210125)
  • AND
  • cpe:/h:tp-link:archer_a7:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:tp-link:archer_a7_firmware:*:*:*:*:*:*:*:* (Version < a7(us)_v5_200220)
  • AND
  • cpe:/h:tp-link:archer_a7:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    tp-link archer a7 firmware *
    tp-link archer a7 -
    tp-link archer a7 firmware *
    tp-link archer a7 -