Details of VAR-202303-1251

ID

VAR-202303-1251

CVE

CVE-2023-27332

TITLE

TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-23-245

DESCRIPTION

TP-Link Archer AX21 tdpServer Logging Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer AX21 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the logging functionality of the tdpServer program, which listens on UDP port 20002. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19898. TP-LINK Archer AX21 is a wireless router from China's TP-LINK company

Trust: 2.07

sources: NVD: CVE-2023-27332 // ZDI: ZDI-23-245 // CNVD: CNVD-2024-31400

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-31400

AFFECTED PRODUCTS

vendor:

tp link

model:

archer ax21

scope:

version:

Trust: 1.3

sources: ZDI: ZDI-23-245 // CNVD: CNVD-2024-31400

CVSS

SEVERITY

CVSSV2

CVSSV3

zdi-disclosures@trendmicro.com:	CVE-2023-27332
value:	HIGH
Trust: 1.0
ZDI:	CVE-2023-27332
value:	HIGH
Trust: 0.7
CNVD:	CNVD-2024-31400
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-31400
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

zdi-disclosures@trendmicro.com:	CVE-2023-27332
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.0
ZDI:	CVE-2023-27332
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 0.7

sources: ZDI: ZDI-23-245 // CNVD: CNVD-2024-31400 // NVD: CVE-2023-27332

PROBLEMTYPE DATA

problemtype:

CWE-121

Trust: 1.0

sources: NVD: CVE-2023-27332

PATCH

title:	Fixed in Archer AX21 version V3230219 #Firmware	url:	https://www.tp-link.com/us/support/download/archer-ax21/	Trust: 0.7
title:	Patch for TP-LINK Archer AX21 has a stack buffer overflow vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/567966	Trust: 0.6

sources: ZDI: ZDI-23-245 // CNVD: CNVD-2024-31400

EXTERNAL IDS

db:	NVD	id:	CVE-2023-27332	Trust: 2.3
db:	ZDI	id:	ZDI-23-245	Trust: 1.7
db:	ZDI_CAN	id:	ZDI-CAN-19898	Trust: 0.7
db:	CNVD	id:	CNVD-2024-31400	Trust: 0.6

sources: ZDI: ZDI-23-245 // CNVD: CNVD-2024-31400 // NVD: CVE-2023-27332

REFERENCES

url:	https://www.zerodayinitiative.com/advisories/zdi-23-245/	Trust: 1.0
url:	https://www.tp-link.com/us/support/download/archer-ax21/	Trust: 0.7
url:	https://nvd.nist.gov/vuln/detail/cve-2023-27332	Trust: 0.6

sources: ZDI: ZDI-23-245 // CNVD: CNVD-2024-31400 // NVD: CVE-2023-27332

CREDITS

Reported by Xiaobye, working with DEVCORE Internship Program

Trust: 0.7

sources: ZDI: ZDI-23-245

SOURCES

db:	ZDI	id:	ZDI-23-245
db:	CNVD	id:	CNVD-2024-31400
db:	NVD	id:	CVE-2023-27332

LAST UPDATE DATE

2024-09-19T23:04:32.203000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-23-245	date:	2023-03-15T00:00:00
db:	CNVD	id:	CNVD-2024-31400	date:	2024-07-11T00:00:00
db:	NVD	id:	CVE-2023-27332	date:	2024-09-18T19:15:19.710

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-23-245	date:	2023-03-15T00:00:00
db:	CNVD	id:	CNVD-2024-31400	date:	2024-05-02T00:00:00
db:	NVD	id:	CVE-2023-27332	date:	2024-05-03T02:15:10.103