Vulnerability · Published Apr 14, 2021 · Assigned by zdi

CVE-2021-27246

High 8.0

In plain English

A high-severity stack buffer overflow in AC1750 from TP-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.6% (higher than 94% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.0)8.0High

Exploit odds (30 days)6.6%top 6.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of MAC addresses by the tdpServer endpoint. A crafted TCP message can write stack pointers to the stack. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-12306.

Affected products (as reported)

Vendor	Product	Versions
TP-Link	AC1750	1.0.15 Build 20200628 rel.63501(4341)

Weakness: CWE-121 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.zerodayinitiative.com/advisories/ZDI-21-215/ x_refsource_MISC