CVE-2020-28347 : tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the sl

tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled.

Published 2020-11-08 20:15:12

Updated 2021-07-21 11:39:24

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Exploit prediction scoring system (EPSS) score for CVE-2020-28347

EPSS FAQ

5.61%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-28347

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

Disclosure Date: 2020-03-25

First seen: 2020-04-26

exploit/linux/misc/tplink_archer_a7_c7_lan_rce

This module exploits a command injection vulnerability in the tdpServer daemon (/usr/bin/tdpServer), running on the router TP-Link Archer A7/C7 (AC1750), hardware version 5, MIPS Architecture, firmware version 190726. The vulnerability can only be exploited by an attac

More information

CVSS scores for CVE-2020-28347

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-28347

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-28347

https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md

PoC/minesweeper.md at master · pedrib/PoC · GitHub
Exploit;Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/14365

Update TP-Link AC1750 Pwn2Own 2019 module by pedrib · Pull Request #14365 · rapid7/metasploit-framework · GitHub
Exploit;Patch;Third Party Advisory
https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md

Exploits_and_Advisories/minesweeper.md at master · rdomanski/Exploits_and_Advisories · GitHub
Exploit;Third Party Advisory
https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md

Exploits_and_Advisories/lao_bomb.md at master · rdomanski/Exploits_and_Advisories · GitHub
Exploit;Third Party Advisory
https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md

PoC/lao_bomb.md at master · pedrib/PoC · GitHub
Exploit;Third Party Advisory

Products affected by CVE-2020-28347

Tp-link » Ac1750 Firmware
Versions before (<) 201029
cpe:2.3:o:tp-link:ac1750_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Tp-link » Ac1750 » Version: A7