Skip to content

Critical Vulnerabilities Allow Remote Hackers To Take Control of TP-Link and NetComm Routers

paul pon raj

Security researchers have uncovered critical vulnerabilities in routers manufactured by TP-Link and NetComm that could allow hackers to gain remote access and execute code on the devices.

These vulnerabilities, found in the TP-Link WR710N-V1-151022 and Archer-C5-V2-160201 small office/home office (SOHO) routers, were identified by Microsoft security researcher James Hull.

The first vulnerability, known as CVE-2022-4498, is a heap overflow caused by crafted packets received during HTTP basic authentication mode. This can be exploited to cause a denial-of-service (DoS) condition or for remote code execution.

The second vulnerability, CVE-2022-4499, is a side-channel attack that allows an attacker to guess each byte of the username and password strings.

TP-Link was notified of these flaws in November 2022, but both issues remain unpatched. In a separate advisory, the CERT Coordination Center at Carnegie Mellon University warns of two vulnerabilities impacting NetComm NF20MESH, NF20, and NL1902 router models.

The vendor has released patches for both bugs.

The first of the issues, CVE-2022-4873, is described as a buffer overflow that could lead to an application crash. The second, CVE-2022-4874, is an authentication bypass leading to unauthorized access to content.

When combined, these vulnerabilities permit a remote, unauthenticated attacker to execute arbitrary code.

NetComm has released a firmware update that addresses these flaws in December 2022. The company has said that the vulnerabilities were introduced in code from its chipset provider, Broadcom. Broadcom, however, denied any responsibility, claiming that the code was not vulnerable.

Read In Detail