CVE-2022-24353 in AC1750
Summary
by MITRE • 03/28/2023
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-15769.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/03/2026
The vulnerability identified as CVE-2022-24353 represents a critical remote code execution flaw in TP-Link AC1750 routers running firmware version 1.1.4 Build 20211022 rel.59103(5553). This vulnerability operates at the kernel level through the NetUSB.ko module, which is responsible for USB network functionality within the router's operating system. The flaw stems from insufficient input validation mechanisms that fail to properly sanitize user-supplied data before processing, creating a dangerous condition where malicious inputs can cause the system to read beyond allocated memory boundaries. This type of vulnerability falls under the CWE-125 category of out-of-bounds read errors, which represents a fundamental memory safety issue that can be exploited to gain unauthorized system access.
The security implications of this vulnerability are severe as it enables network-adjacent attackers to execute arbitrary code without requiring any authentication credentials, making it particularly dangerous in environments where routers are accessible from untrusted networks. The attack vector is particularly concerning because it does not require the attacker to have legitimate network credentials or physical access to the device. The vulnerability specifically targets the NetUSB.ko kernel module, which suggests that the issue originates from how the router handles USB network connections and related network protocols. This module likely handles incoming network traffic that is processed through USB interfaces, creating a pathway for malicious data to be interpreted and executed with elevated privileges.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as successful exploitation results in code execution with root privileges, effectively granting attackers complete control over the affected router. This level of access allows adversaries to modify router configurations, establish persistent backdoors, redirect network traffic, or use the compromised device as a launch point for further attacks against the local network. The fact that this vulnerability can be exploited remotely from adjacent network segments means that attackers do not need to be physically present or have direct network access to the device, potentially allowing for large-scale attacks against multiple devices within the same network segment. This vulnerability aligns with ATT&CK technique T1059.007 for command and script interpreter, where attackers can execute code through compromised network devices.
Mitigation strategies for this vulnerability should include immediate firmware updates from TP-Link to address the underlying buffer overflow in the NetUSB.ko module, as well as network segmentation to limit the exposure of these devices to untrusted networks. Network administrators should implement firewall rules to restrict access to router management interfaces and consider disabling unnecessary USB network functionality when not actively required. The vulnerability demonstrates the importance of proper input validation and memory safety practices in embedded systems, particularly those handling network traffic and USB interfaces. Organizations should also implement continuous monitoring for unauthorized changes to router configurations and network traffic patterns that might indicate exploitation attempts. The vulnerability highlights the need for robust security testing of kernel modules and proper memory management practices in embedded operating systems to prevent similar issues from occurring in other network infrastructure devices.