Описание
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 rel.73164(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14655.
Ссылки
- Third Party AdvisoryVDB Entry
- Third Party AdvisoryVDB Entry
Уязвимые конфигурации
Одновременно
EPSS
9.8 Critical
CVSS3
9.8 Critical
CVSS3
10 Critical
CVSS2
Дефекты
Связанные уязвимости
This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 1.0.6 Build 20200114 rel.73164(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14655.
Уязвимость микропрограммного обеспечения маршрутизаторов TP-Link Archer C90, вызванная переполнением буфера на стеке, позволяющая нарушителю выполнить произвольный код
EPSS
9.8 Critical
CVSS3
9.8 Critical
CVSS3
10 Critical
CVSS2