Details of VAR-202003-0261

ID

VAR-202003-0261

CVE

CVE-2020-10882

TITLE

TP-Link Archer A7 AC1750 In firmware OS Command injection vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2020-003493

DESCRIPTION

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP port 20002 by default. When parsing the slave_mac parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650. TP-Link Archer A7 AC1750 For firmware, OS A command injection vulnerability exists. Zero Day Initiative To this vulnerability ZDI-CAN-9650 Was numbered.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. TP-Link Archer A7 AC1750 is a wireless router of China TP-Link company. The vulnerability stems from the program's failure to correctly verify the string submitted by the user before making a system call

Trust: 2.88

sources: NVD: CVE-2020-10882 // JVNDB: JVNDB-2020-003493 // ZDI: ZDI-20-334 // CNVD: CNVD-2020-19937 // VULMON: CVE-2020-10882

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-19937

AFFECTED PRODUCTS

vendor:	tp link	model:	ac1750	scope:	eq	version:	190726	Trust: 1.0
vendor:	tp link	model:	ac 1750	scope:	eq	version:	190726	Trust: 0.8
vendor:	tp link	model:	archer a7	scope:	-	version:	-	Trust: 0.7
vendor:	tp link	model:	archer a7 ac1750	scope:	eq	version:	190726	Trust: 0.6

sources: ZDI: ZDI-20-334 // CNVD: CNVD-2020-19937 // JVNDB: JVNDB-2020-003493 // NVD: CVE-2020-10882

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-10882
value:	HIGH
Trust: 1.0
zdi-disclosures@trendmicro.com:	CVE-2020-10882
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-003493
value:	HIGH
Trust: 0.8
ZDI:	CVE-2020-10882
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2020-19937
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202003-1606
value:	HIGH
Trust: 0.6
VULMON:	CVE-2020-10882
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2020-10882
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2020-003493
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-19937
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-10882
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.1
Trust: 1.0
zdi-disclosures@trendmicro.com:	CVE-2020-10882
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.0
NVD:	JVNDB-2020-003493
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8
ZDI:	CVE-2020-10882
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-20-334 // CNVD: CNVD-2020-19937 // VULMON: CVE-2020-10882 // JVNDB: JVNDB-2020-003493 // CNNVD: CNNVD-202003-1606 // NVD: CVE-2020-10882 // NVD: CVE-2020-10882

PROBLEMTYPE DATA

problemtype:

CWE-78

Trust: 1.8

sources: JVNDB: JVNDB-2020-003493 // NVD: CVE-2020-10882

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-202003-1606

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202003-1606

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-003493

PATCH

title:	Top Page	url:	https://www.tp-link.com/br/	Trust: 0.8
title:	Patch for TP-Link Archer A7 AC1750 operating system command injection vulnerability (CNVD-2020-19937)	url:	https://www.cnvd.org.cn/patchInfo/show/211379	Trust: 0.6
title:	TP-Link Archer A7 AC1750 Fixes for operating system command injection vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=113012	Trust: 0.6
title:	-	url:	https://github.com/Live-Hack-CVE/CVE-2020-10882	Trust: 0.1

sources: CNVD: CNVD-2020-19937 // VULMON: CVE-2020-10882 // JVNDB: JVNDB-2020-003493 // CNNVD: CNNVD-202003-1606

EXTERNAL IDS

db:	NVD	id:	CVE-2020-10882	Trust: 3.8
db:	ZDI	id:	ZDI-20-334	Trust: 3.2
db:	PACKETSTORM	id:	157255	Trust: 1.7
db:	JVNDB	id:	JVNDB-2020-003493	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-9650	Trust: 0.7
db:	CNVD	id:	CNVD-2020-19937	Trust: 0.6
db:	EXPLOIT-DB	id:	48331	Trust: 0.6
db:	CNNVD	id:	CNNVD-202003-1606	Trust: 0.6
db:	VULMON	id:	CVE-2020-10882	Trust: 0.1

sources: ZDI: ZDI-20-334 // CNVD: CNVD-2020-19937 // VULMON: CVE-2020-10882 // JVNDB: JVNDB-2020-003493 // CNNVD: CNNVD-202003-1606 // NVD: CVE-2020-10882

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-20-334/	Trust: 2.5
url:	http://packetstormsecurity.com/files/157255/tp-link-archer-a7-c7-unauthenticated-lan-remote-code-execution.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-10882	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10882	Trust: 0.8
url:	https://www.exploit-db.com/exploits/48331	Trust: 0.6
url:	https://cwe.mitre.org/data/definitions/78.html	Trust: 0.1
url:	https://github.com/live-hack-cve/cve-2020-10882	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-10882 // JVNDB: JVNDB-2020-003493 // CNNVD: CNNVD-202003-1606 // NVD: CVE-2020-10882

CREDITS

Pedro Ribeiro and Radek Domanski of Team Flashback

Trust: 0.7

sources: ZDI: ZDI-20-334

SOURCES

db:	ZDI	id:	ZDI-20-334
db:	CNVD	id:	CNVD-2020-19937
db:	VULMON	id:	CVE-2020-10882
db:	JVNDB	id:	JVNDB-2020-003493
db:	CNNVD	id:	CNNVD-202003-1606
db:	NVD	id:	CVE-2020-10882

LAST UPDATE DATE

2024-11-23T22:44:39.342000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-334	date:	2020-03-25T00:00:00
db:	CNVD	id:	CNVD-2020-19937	date:	2020-03-29T00:00:00
db:	VULMON	id:	CVE-2020-10882	date:	2023-02-03T00:00:00
db:	JVNDB	id:	JVNDB-2020-003493	date:	2020-04-17T00:00:00
db:	CNNVD	id:	CNNVD-202003-1606	date:	2020-04-17T00:00:00
db:	NVD	id:	CVE-2020-10882	date:	2024-11-21T04:56:16.887

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-334	date:	2020-03-25T00:00:00
db:	CNVD	id:	CNVD-2020-19937	date:	2020-03-28T00:00:00
db:	VULMON	id:	CVE-2020-10882	date:	2020-03-25T00:00:00
db:	JVNDB	id:	JVNDB-2020-003493	date:	2020-04-17T00:00:00
db:	CNNVD	id:	CNNVD-202003-1606	date:	2020-03-25T00:00:00
db:	NVD	id:	CVE-2020-10882	date:	2020-03-25T21:15:11.917