CVE-2019-7406 in TP-Link Wi-Fi Extenders Can Be Exploited without Authentication
CYBER NEWS

CVE-2019-7406 in TP-Link Wi-Fi Extenders Can Be Exploited without Authentication

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

IBM researchers just discovered another serious zero-day vulnerability, this time impacting TP-Link Wi-Fi Extenders. The vulnerability (known as to CVE-2019-7406) could lead to remote code execution attacks and affects TP-Link Wi-Fi Extender models RE365, RE650, RE350 and RE500 running firmware version 1.0.2, build 20180213.




More about to CVE-2019-7406

The CVE-2019-7406 vulnerability was discovered by security researcher Grzegorz Wypychmembers of IBM X-Force. In case of a successful attack, the RCE bug could allow arbitrary command execution via a malformed user agent field in HTTP headers.

In other words, a remote attacker could get complete control over the device and command it with the same privileges of the device’s legitimate user. The issue is serious as it affects both home and commercial properties where TP-Link Wi-Fi Extenders are utilized. The extenders are devices that can amplify a Wi-Fi signal, and as such have a broad usage.

The researcher exploited the zero-day vulnerability in TP-Link RE365 Wi-Fi extender with firmware version 1.0.2, build 20180213 Rel. 56309. However, after internal testing, TP-Link confirmed that three other models are also affected: RE650, RE350 and RE500.

Related: TP-Link SR20 Smart Home Routers Contain Zero-Day Flaw

What’s mostly surprising about CVE-2019-7406 is that it can be exploited by a remote attacker without requiring login/authentication to the Wi-Fi extender device. This means that privilege escalation is not required, because extenders already run with root-level access. This default condition is quite risky as attackers can perform a wide range of attacks.

The sort of impact one can expect from such unauthenticated access is, for example, requesting the device to browse to a botnet command and control server or an infection zone,” the researcher sad. “The thought of a Mirai infection on IoT devices is, of course, one of the first things that come to mind, where automated scripts could potentially run as root on this type of a device if the vulnerability is exploited.”

It’s highly advisable to mitigate the risk caused by CVE-2019-7406 by implementing compensating controls or a patch as soon as one becomes available, Wypychmembers concluded.

Avatar

Milena Dimitrova

An inspired writer and content manager who has been with SensorsTechForum for 4 years. Enjoys ‘Mr. Robot’ and fears ‘1984’. Focused on user privacy and malware development, she strongly believes in a world where cybersecurity plays a central role. If common sense makes no sense, she will be there to take notes. Those notes may later turn into articles!

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...