Tenable Research Advisory: Popular TP-Link Router is Vulnerable to Remote Exploitation

Tenable Research has discovered multiple vulnerabilities in the TP-Link TL-WRN841N, a popular consumer router, one of which could be used by an attacker to remotely take over the device.

• What do you need to know? Multiple vulnerabilities in TP-Link's popular TL-WRN841N router were discovered by Tenable Research.
• What’s the attack vector? Targeting unauthenticated users of the TL-WRN841N router’s web server.
• What’s the business impact? An attacker can obtain full control over the router, uploading a new configuration file that will change the admin credentials as well as enable remote access to control the device remotely.
• What’s the solution? TP-Link plans to release a patch that will address these vulnerabilities.

Background

Tenable Researcher David Wells discovered multiple vulnerabilities in the TP-Link TL-WRN841N, a popular wireless router which boasts an average rating of four stars on Amazon with more than 12,000 reviews.

Analysis

The first vulnerability in the TL-WRN841N is an improper authentication flaw, which we discovered independently during our research. It was also reported to TP-Link at the same time by a third-party researcher. It received a CVE identifier of CVE-2018-11714. This vulnerability is local, as it would allow unauthenticated attackers to trigger a set of sensitive CGI routines in the router’s admin webpage by spoofing the HTTP Referrer request from "tplinkwifi.net," "tplinklogin.net" or the router's IP address.

Our research led us to discover a second vulnerability, a cross-site request forgery (CSRF) flaw in the HTTP referrer whitelist check function in the router’s httpd service. It received a CVE identifier of CVE-2018-15702. It uses a string comparison function, strncmp, which checks to see whether or not the URL contained in the HTTP referrer field matches one of the whitelisted domains. However, this check is performed in such a way that it only looks at a certain length of characters within the string. Therefore, an attacker could craft a malicious iframe pointing to a URL with the subdomain "tplinkwifi.net" or "tplinklogin.net" (e.g. hxxp://tplinkwifi.net.drive-by-attack[.]com) and the router would consider it part of its whitelisted domains. This CSRF, combined with the improper authentication vulnerability, could allow an attacker to obtain full control over the router by uploading a malicious configuration file that would overwrite the admin credentials and even enable access to the router’s remote administration interface.

Additionally, we discovered two local/unauthenticated denial of service (DoS) vulnerabilities, both of which can cause the httpd service to crash by sending a malformed HTTP request, requiring the router to be restarted.

Proof of Concept

The researcher who discovered these has also developed a proof of concept of the CSRF vulnerability.

Solution

As of this publication, a patch for these vulnerabilities has not been released. Tenable Research has been communicating and working with TP-Link to ensure these vulnerabilities are addressed in an upcoming firmware update. Impacted end-users can contact the vendor directly for further information. We will update this blog with a link to the vendor’s patch when it is made available.

Identifying Affected Systems

Tenable has the following plugins available for identifying vulnerable assets.

Additional information:

• Read the Tenable Research Advisory.
• Visit the Tenable Techblog on Medium to read researcher David Wells' in-depth story about his work uncovering this vulnerability.

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.