PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

TP-Link TL-WR940N: 1-days analysis after story. (CVE-2022-43636 & CVE-2022-43635)

blog.viettelcybersecurity.com | vulnerability | #authentication-bypass | #router | #firmware-analysis | #tp-link | #cve-2022-43636 | #cve-2022-43635
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Analysis of TP-Link TL-WR940N (CVE-2022-43636/43635): AuthPass() in the RSA/AES-protected login flow always returns success, letting attackers reuse stale session IDs to bypass authentication.
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
1day to 0day(CVE-2022-30024) on TP-Link TL-WR841N
Studying TP-Link TL-WR841N firmware, the author revisits CVE-2020-8423 and finds 0-day CVE-2022-30024: stringModify() miscounts escaped characters, overflowing a stack buffer via the survey page.
vulnerability · blog.viettelcybersecurity.com
TP-Link TL-WR940N: Analysis of a 1day (CVE-2022-24355) Buffer Overflow RCE Vulnerability
The author reverse-engineers CVE-2022-24355 on TP-Link TL-WR940N: the flaw sits in the Content-Type detection routine sub_5299E0, overflowing a stack buffer via file extensions for pre-auth root RCE.
vulnerability · blog.viettelcybersecurity.com
NETGEAR R6700v3: 1day Analysis (CVE-2021-34982) Buffer Overflow RCE Vulnerability
The author traces CVE-2021-34982 on NETGEAR R6700v3 to Create_Hashtable() in the httpd String File Table Upload handler: unvalidated gui_region overflows a stack buffer, enabling pre-auth root RCE.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên thiết bị D-link
A researcher dissects a buffer overflow in the D-Link DIR-601 web service: request paths are concatenated via strcat without length checks, so a long URL overflows the buffer on this EOL router.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên dòng ONT IGate GW040
Research on ONT IGate GW040 routers: the crontab and weakly secured TR-069 features allow easy botnet recruitment, and firmware analysis uncovered command injection in /bin/httpd via IPSec requests.
research · blog.quarkslab.com
Reverse Engineering a VxWorks OS Based Router
A reverse engineering walkthrough of a TP-Link TL-WR543G router running VxWorks: firmware extraction, binary analysis, memory layout and the pitfalls encountered along the way.
Back