The
TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking
module that can lead to a stack-based buffer overflow. The issue occurs when a
LAN client initiates a connection to a malicious RTSP server controlled by an
attacker. A specially crafted RTSP message may trigger improper memory handling
within the kernel module
Successful
exploitation of this vulnerability may result in a denial-of-service (DoS)
condition or allow remote code execution (RCE), potentially leading to full
compromise of the device.
This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://www.tp-link.com/en/support/download/tl-wr940n/v6/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/jp/support/download/tl-wr940n/v6/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/us/support/download/tl-wr940n/v6/#Firmware
f23511db-6c3e-4e32-a477-6aa17d310630
https://www.tp-link.com/us/support/faq/5213/
f23511db-6c3e-4e32-a477-6aa17d310630