(Pwn2Own) TP-Link Archer AX21 merge_country_config Command Injection Remote Code Execution Vulnerability
Vulnerability Details
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the merge_country_config function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute arbitrary code in the context of root.
Additional Details
TP-Link has issued an update to correct this vulnerability. More details can be found at:
https://www.tp-link.com/us/support/download/archer-ax21/v3/#Firmware
Disclosure Timeline
- 2023-01-25 - Vulnerability reported to vendor
- 2023-04-24 - Coordinated public release of advisory
Credit
rskvp93, Q5Ca, and hoangnx99 from VcsLab of Viettel Cyber Security and Pham Nguyen Ngoc Bien & Dang Minh Tri from Qrious Secure
