CVE-2020-10884 : This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.

Published 2020-03-25 21:15:12

Updated 2023-02-16 03:21:17

Source Zero Day Initiative

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2020-10884

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-10884

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

Disclosure Date: 2020-03-25

First seen: 2020-04-26

exploit/linux/misc/tplink_archer_a7_c7_lan_rce

This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attac

More information

CVSS scores for CVE-2020-10884

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.8	MEDIUM	AV:A/AC:L/Au:N/C:P/I:P/A:P	6.5	6.4	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	2.8	5.2	Zero Day Initiative
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: None
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-10884

CWE-321 Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Assigned by: zdi-disclosures@trendmicro.com (Secondary)
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-10884

https://www.zerodayinitiative.com/advisories/ZDI-20-336/

ZDI-20-336 | Zero Day Initiative
Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/157255/TP-Link-Archer-A7-C7-Unauthenticated-LAN-Remote-Code-Execution.html

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2020-10884

Tp-link » Ac1750 Firmware » Version: 190726
cpe:2.3:o:tp-link:ac1750_firmware:190726:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Ac1750 » Version: N/A