CVE-2023-39471: TP-Link TL-WR841N, инжекция

Описание

Оригинално описание

TP-Link TL-WR841N ated_tp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ated_tp service. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21825.

Засегнати продукти

• TP-Link TL-WR841N: 4.19
• tp-link tl-wr840n: преди 6.2

Вид слабост

• CWE-78 Инжектиране на команди към операционната система

История

Други уязвимости в TP-Link TL-WR841N

• 6.5CVE-2023-50224
• CVE-2023-36489
• CVE-2023-39745
• CVE-2023-36354
• 6.4CVE-2022-42433

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-39471
• https://nvd.nist.gov/vuln/detail/CVE-2023-39471
• https://www.zerodayinitiative.com/advisories/ZDI-23-1624/