CVE-2021-27246

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 AC1750 1.0.15 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of MAC addresses by the tdpServer endpoint. A crafted TCP message can write stack pointers to the stack. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-12306.

CVSS v3.1

8.0 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.0

8.0 HIGHCVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

7.9 HIGHAV:A/AC:M/Au:N/C:C/I:C/A:C

EPSS

6.60% chance of exploitation in the next 30 days, 93th percentile

Published

2021-04-14

Updated

2024-08-03

Proof-of-concept exploits (1)

• synacktiv/CVE-2021-27246_Pwn2Own202043★ · 2021-03-02

Exploit collections (1)

• tzwlhack/Vulnerability/blob/main/TP-Link%20AC1750%20%E9%A2%84%E8%AE%A4%E8%AF%81%E8%BF%9C%…

References

• CVE Record
• NVD entry

Related

• CVE-2018-6789
• CVE-2019-15846
• CVE-2019-8942
• CVE-2020-27950
• CVE-2020-9289
• CVE-2021-1782