---
id: 7361
title: "TP-Link TL-WR940N: Analysis of a 1day (CVE-2022-24355) Buffer Overflow RCE Vulnerability"
cve: CVE-2022-24355
source_domain: blog.viettelcybersecurity.com
source_url: "https://blog.viettelcybersecurity.com/tp-link-tl-wr940n-httpd-httprpmfs-stack-based-buffer-overflow-remote-code-execution-vulnerability/"
published_at: "2022-04-08T04:46:17Z"
tags: ["rce", "buffer-overflow", "router", "firmware-analysis", "tp-link", "cve-2022-24355"]
phying_url: "https://phying.com/item/7361"
lang: en
---

# TP-Link TL-WR940N: Analysis of a 1day (CVE-2022-24355) Buffer Overflow RCE Vulnerability

## Summary

The author reverse-engineers CVE-2022-24355 on TP-Link TL-WR940N: the flaw sits in the Content-Type detection routine sub_5299E0, overflowing a stack buffer via file extensions for pre-auth root RCE.

## Intelligence Metadata

- **Sources:** blog.viettelcybersecurity.com
- **CVE:** CVE-2022-24355
- **Published:** 2022-04-08T04:46:17Z
- **Original:** https://blog.viettelcybersecurity.com/tp-link-tl-wr940n-httpd-httprpmfs-stack-based-buffer-overflow-remote-code-execution-vulnerability/
- **Phying News:** https://phying.com/item/7361