CVE-2020-28347
📋 TL;DR
CVE-2020-28347 is a command injection vulnerability in the tdpServer component of TP-Link Archer A7 AC1750 routers that allows remote attackers to execute arbitrary code via the slave_mac parameter. This vulnerability affects users of TP-Link Archer A7 AC1750 routers with firmware versions before 201029. The issue exists due to incomplete sanitization of shell commands after a previous fix attempt for CVE-2020-10882.
💻 Affected Systems
- TP-Link Archer A7 AC1750
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full root access to the router, enabling them to intercept all network traffic, install persistent malware, pivot to internal network devices, and potentially brick the device.
Likely Case
Remote code execution leading to router compromise, network traffic interception, DNS hijacking, and credential theft from connected devices.
If Mitigated
No impact if router is patched or network segmentation prevents access to vulnerable service.
🎯 Exploit Status
Multiple public PoCs and Metasploit modules exist. Exploitation requires network access to the router's TDDP service (typically UDP port 1040).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 201029 or later
Vendor Advisory: https://www.tp-link.com/us/support/download/archer-a7/#Firmware
Restart Required: Yes
Instructions:
1. Download latest firmware from TP-Link support site. 2. Log into router admin interface. 3. Navigate to System Tools > Firmware Upgrade. 4. Upload firmware file. 5. Wait for upgrade to complete and router to reboot.
🔧 Temporary Workarounds
Block TDDP Port
linuxBlock UDP port 1040 at network perimeter to prevent external exploitation
iptables -A INPUT -p udp --dport 1040 -j DROP
Disable Remote Management
allDisable remote management features in router settings
🧯 If You Can't Patch
- Replace vulnerable router with updated model or different vendor
- Implement strict network segmentation to isolate router from critical systems
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is earlier than 201029, device is vulnerable.Check Version:
Check via router web interface at 192.168.0.1 or 192.168.1.1Verify Fix Applied:
Verify firmware version shows 201029 or later in router admin interface after upgrade.📡 Detection & Monitoring
Log Indicators:
- Unusual TDDP protocol traffic
- Unexpected shell command execution in router logs
- Failed firmware upgrade attempts
Network Indicators:
- UDP traffic to port 1040 with shell metacharacters in payload
- Outbound connections from router to suspicious IPs
SIEM Query:
source="router" AND (port=1040 OR protocol="TDDP" OR "slave_mac" IN payload)🔗 References
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md
- https://github.com/rapid7/metasploit-framework/pull/14365
- https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md
- https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2019/lao_bomb/lao_bomb.md
- https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Tokyo_2020/minesweeper.md
- https://github.com/rapid7/metasploit-framework/pull/14365
- https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2019/lao_bomb.md
- https://github.com/rdomanski/Exploits_and_Advisories/blob/master/advisories/Pwn2Own/Tokyo2020/minesweeper.md
