{"id":163762,"date":"2024-05-28T06:23:53","date_gmt":"2024-05-28T06:23:53","guid":{"rendered":"https:\/\/securityaffairs.com\/?p=163762"},"modified":"2024-05-28T06:23:55","modified_gmt":"2024-05-28T06:23:55","slug":"tp-link-archer-c5400x-critical-flaw","status":"publish","type":"post","link":"https:\/\/securityaffairs.com\/163762\/hacking\/tp-link-archer-c5400x-critical-flaw.html","title":{"rendered":"TP-Link Archer C5400X gaming router is affected by a critical flaw<\/gwmw>"},"content":{"rendered":"
<\/div>\n

Researchers warn of a critical remote code execution vulnerability in TP-Link Archer C5400X gaming router.<\/h2>\n\n\n\n

Researchers at OneKey<\/a> discovered a a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-5035<\/a> (CVSS score 10.0), in TP-Link Archer C5400X gaming router.<\/p>\n\n\n\n

A remote, unauthenticated, attacker can exploit the vulnerability to execute commands on the device.<\/p>\n\n\n\n

The TP-Link Archer C5400X is a high-performance gaming router designed for demanding applications such as online gaming and streaming.<\/p>\n\n\n\n

The vulnerability resides in a binary called “rftest” that is executed during device startup. The researchers discovered that the binary exposes a network service that is susceptible to unauthenticated command injection and buffer overflows on TCP ports 8888, 8889, and 8890<\/gwmw><\/gwmw><\/p>\n\n\n\n

“By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated privileges.” reads the report<\/a> published by the OneKey. “It\u2019s unclear whether the binary is always launched and whether it is always exposed on LAN\/WAN interfaces. We reproduced the issue within an emulator, but production device may behave differently. We put our trust in TP-Link in assessing the actual exposure of this vulnerability.<\/gwmw>“<\/em><\/gwmw><\/gwmw><\/p>\n\n\n\n

The experts noticed that upon executing the binary, it starts a TCP server on port 8888, accepting commands from clients. The binary only accepts commands starting with “wl” or “nvram get”. However, this limitation can be bypassed for command injection by appending shell meta-characters like “;”, “&”, or “|”.<\/p>\n\n\n

\n
\"TP-Link<\/a><\/figure><\/div>\n\n\n

<\/gwmw>TP-Link addressed the issue by discarding any command containing shell meta-characters.<\/p>\n\n\n\n

The issue affects firmware\u00a0versions,\u00a0through 1.1.1.6, Archer C5400X(EU)_V1_1.1.7 Build 20240510\u00a0addressed the flaw.<\/p>\n\n\n\n

Below is the timeline for this flaw:<\/p>\n\n\n\n