Critical Security Vulnerabilities Discovered in Netcomm and TP-Link Routers

Jan 18, 2023Ravie LakshmananNetwork Security

Security vulnerabilities have been disclosed in Netcomm and
TP-Link routers, some of which could be weaponized to achieve
remote code execution.

The flaws, tracked as CVE-2022-4873^[1]
and CVE-2022-4874^[2], concern a case of
stack-based buffer overflow and authentication bypass and impact
Netcomm router models NF20MESH, NF20, and NL1902 running software
versions earlier than R6B035.

“The two vulnerabilities, when chained together, permit a
remote, unauthenticated attacker to execute arbitrary code,” the
CERT Coordination Center (CERT/CC) said^[3] in an advisory published
Tuesday.

“The attacker can first gain unauthorized access to affected
devices, and then use those entry points to gain access to other
networks or compromise the availability, integrity, or
confidentiality of data being transmitted from the internal
network.”

Security researcher Brendan Scarvell^[4]
has been credited with discovering and reporting the issues in
October 2022.

In a related development, CERT/CC also detailed two unpatched
security vulnerabilities affecting TP-Link routers WR710N-V1-151022
and Archer-C5-V2-160201 that could lead to information disclosure
(CVE-2022-4499^[5]) and remote code
execution (CVE-2022-4498^[6]).

CVE-2022-4499 is also a side-channel attack targeting a function
used to validate the entered credentials. “By measuring the
response time of the vulnerable process, each byte of the username
and password strings may be easier to guess,” CERT/CC said^[7].

Microsoft researcher James Hull has been acknowledged for
disclosing the two bugs. The Hacker News has reached out to TP-Link
for a comment, and we will update the story if we hear back.