TP-LINK TL-R600VPN HTTP Server header-parsing HTTP Request memory corruption

Summaryinfo

A vulnerability labeled as critical has been found in TP-LINK TL-R600VPN. Affected is the function header-parsing of the component HTTP Server. The manipulation as part of HTTP Request results in memory corruption. This vulnerability was named CVE-2018-3951. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in TP-LINK TL-R600VPN (Router Operating System) (the affected version unknown). Affected is the function header-parsing of the component HTTP Server. The manipulation as part of a HTTP Request leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An exploitable remote code execution vulnerability exists in the HTTP header-parsing function of the TP-Link TL-R600VPN HTTP Server. A specially crafted HTTP request can cause a buffer overflow, resulting in remote code execution on the device. An attacker can send an authenticated HTTP request to trigger this vulnerability.

The bug was discovered 11/19/2018. The weakness was presented 12/01/2018 (Website). The advisory is shared for download at talosintelligence.com. This vulnerability is traded as CVE-2018-3951 since 01/02/2018. It is possible to launch the attack remotely. A authentication is necessary for exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 12 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-127367, VDB-127366 and VDB-127365 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• TP-LINK

Name

• TL-R600VPN

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion