TP-Link TL-WR940N up to 3.16.9 Wan6to4TunnelCfgRpm.htm dnsserver1/dnsserver2 buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in TP-Link TL-WR940N up to 3.16.9. This vulnerability affects unknown code of the file /userRpm/Wan6to4TunnelCfgRpm.htm. This manipulation of the argument dnsserver1/dnsserver2 causes buffer overflow. The identification of this vulnerability is CVE-2024-54887. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in TP-Link TL-WR940N up to 3.16.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /userRpm/Wan6to4TunnelCfgRpm.htm. The manipulation of the argument dnsserver1/dnsserver2 with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

TP-Link TL-WR940N V3 and V4 with firmware 3.16.9 and earlier contain a buffer overflow via the dnsserver1 and dnsserver2 parameters at /userRpm/Wan6to4TunnelCfgRpm.htm. This vulnerability allows an authenticated attacker to execute arbitrary code on the remote device in the context of the root user.

This vulnerability is known as CVE-2024-54887 since 12/06/2024. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/22/2025).

By approaching the search of inurl:userRpm/Wan6to4TunnelCfgRpm.htm it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-52689). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• TP-Link

Name

• TL-WR940N

Version

• 3.16.0
• 3.16.1
• 3.16.2
• 3.16.3
• 3.16.4
• 3.16.5
• 3.16.6
• 3.16.7
• 3.16.8
• 3.16.9

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion