TP-LINK TL-WDR4300/TL-WR743ND 3.13.23 Build 121225 Rel.37950n TFTP Server start_art.html backdoor ⚔ [Disputed]

Summaryinfo

A vulnerability was found in TP-LINK TL-WDR4300 and TL-WR743ND 3.13.23 Build 121225 Rel.37950n and classified as critical. The affected element is an unknown function of the file userRpmNatDebugRpm26525557/start_art.html of the component TFTP Server. Such manipulation leads to backdoor. Furthermore, an exploit is available. There are still doubts about whether this vulnerability truly exists. Disabling the affected component is advisable.

Detailsinfo

A vulnerability was found in TP-LINK TL-WDR4300 and TL-WR743ND 3.13.23 Build 121225 Rel.37950n (Router Operating System) and classified as very critical. Affected by this issue is an unknown code of the file userRpmNatDebugRpm26525557/start_art.html of the component TFTP Server. The manipulation with an unknown input leads to a backdoor vulnerability. Using CWE to declare the problem leads to CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. Impacted is confidentiality, integrity, and availability.

The weakness was published 03/12/2013 by Sekurak as TP-Link http/tftp backdoor as not defined blog post (Website). The advisory is available at sekurak.pl. The vendor was not involved in the coordination of the public release. scip AG wasn't able to reproduce this problem. Only a denial of service attack was possible. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 05/04/2018). This vulnerability is assigned to T1588.001 by the MITRE ATT&CK project.

A public exploit has been developed by Sekurak in Shell (TFTP) and been published immediately after the advisory. The exploit is available at sekurak.pl. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. By approaching the search of inurl:userRpmNatDebugRpm26525557/start_art.html it is possible to find vulnerable targets with Google Hacking.

Addressing this vulnerability is possible by firewalling Web Server Port. The problem might be mitigated by replacing the product with Netgear, D-Link or Cisco as an alternative. The best possible mitigation is suggested to be disabling the affected component.

The vulnerability is also documented in the vulnerability database at OSVDB (91229†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• TP-LINK

Name

• TL-WDR4300
• TL-WR743ND

Version

• 3.13.23 Build 121225 Rel.37950n

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

Screenshot

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion