TP-Link Archer C50 UART Shell cleartext storage

Summaryinfo

A vulnerability was found in TP-Link Archer C50. It has been declared as problematic. This affects an unknown part of the component UART Shell. The manipulation results in cleartext storage. This vulnerability is reported as CVE-2024-54127. An attack on the physical device is feasible. No exploit exists.

Detailsinfo

A vulnerability classified as problematic has been found in TP-Link Archer C50 (version now known). Affected is some unknown processing of the component UART Shell. The manipulation with an unknown input leads to a cleartext storage vulnerability. CWE is classifying the issue as CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. This is going to have an impact on confidentiality. CVE summarizes:

This vulnerability exists in the TP-Link Archer C50 due to presence of terminal access on a serial interface without proper access control. An attacker with physical access could exploit this by accessing the UART shell on the vulnerable device. Successful exploitation of this vulnerability could allow the attacker to obtain Wi-Fi credentials of the targeted system.

The weakness was disclosed by Amey Chavekar, Khalid Markar and Dr. Faruk Kazi as CIVN-2024-0354. The advisory is shared for download at cert-in.org.in. This vulnerability is traded as CVE-2024-54127 since 11/29/2024. The exploitability is told to be difficult. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1555.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• TP-Link

Name

• Archer C50

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion