PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

1day to 0day(CVE-2022-30024) on TP-Link TL-WR841N

blog.viettelcybersecurity.com | vulnerability | #rce | #zero-day | #buffer-overflow | #router | #firmware-analysis | #tp-link | #cve-2022-30024 | #cve-2020-8423
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Studying TP-Link TL-WR841N firmware, the author revisits CVE-2020-8423 and finds 0-day CVE-2022-30024: stringModify() miscounts escaped characters, overflowing a stack buffer via the survey page.
Published
Collected

Related coverage

vulnerability · blog.viettelcybersecurity.com
TP-Link TL-WR940N: Analysis of a 1day (CVE-2022-24355) Buffer Overflow RCE Vulnerability
The author reverse-engineers CVE-2022-24355 on TP-Link TL-WR940N: the flaw sits in the Content-Type detection routine sub_5299E0, overflowing a stack buffer via file extensions for pre-auth root RCE.
vulnerability · blog.viettelcybersecurity.com
TP-Link TL-WR940N: 1-days analysis after story. (CVE-2022-43636 & CVE-2022-43635)
Analysis of TP-Link TL-WR940N (CVE-2022-43636/43635): AuthPass() in the RSA/AES-protected login flow always returns success, letting attackers reuse stale session IDs to bypass authentication.
vulnerability · blog.viettelcybersecurity.com
NETGEAR R6700v3: 1day Analysis (CVE-2021-34982) Buffer Overflow RCE Vulnerability
The author traces CVE-2021-34982 on NETGEAR R6700v3 to Create_Hashtable() in the httpd String File Table Upload handler: unvalidated gui_region overflows a stack buffer, enabling pre-auth root RCE.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên thiết bị D-link
A researcher dissects a buffer overflow in the D-Link DIR-601 web service: request paths are concatenated via strcat without length checks, so a long URL overflows the buffer on this EOL router.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
blog · blog.viettelcybersecurity.com
Lỗ hổng trên dòng ONT IGate GW040
Research on ONT IGate GW040 routers: the crontab and weakly secured TR-069 features allow easy botnet recruitment, and firmware analysis uncovered command injection in /bin/httpd via IPSec requests.
Back