CVE-2020-35575
📋 TL;DR
This CVE describes a password disclosure vulnerability in TP-Link router web interfaces that allows remote attackers to obtain administrative credentials. Successful exploitation grants full administrative access to the web panel, affecting numerous TP-Link router models. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- TP-Link WA901ND
- Archer C5
- Archer C7
- MR3420
- MR6400
- WA701ND
- WA801ND
- WDR3500
- WDR3600
- WE843N
- WR1043ND
- WR1045ND
- WR740N
- WR741ND
- WR749N
- WR802N
- WR840N
- WR841HP
- WR841N
- WR842N
- WR842ND
- WR845N
- WR940N
- WR941HP
- WR945N
- WR949N
- WRD4300
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full administrative control of router, can reconfigure network settings, intercept traffic, install malware, or use device as pivot point into internal network.
Likely Case
Attacker obtains administrative credentials and gains control of router web interface, potentially changing DNS settings, firewall rules, or network configuration.
If Mitigated
With proper network segmentation and access controls, impact limited to isolated network segment; attacker cannot pivot to critical systems.
🎯 Exploit Status
Exploit details and proof-of-concept code publicly available; simple HTTP request can trigger password disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WA901ND: 3.16.9(201211) beta or later; Other models: check TP-Link security advisory for specific patched versions
Vendor Advisory: https://www.tp-link.com/us/security
Restart Required: Yes
Instructions:
1. Visit TP-Link support site for your specific model. 2. Download latest firmware version. 3. Log into router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Router will reboot automatically.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Log into router > Security > Remote Management > Disable
Change Default Admin Password
allUse strong unique password even if vulnerable
Log into router > System Tools > Password > Set new strong password
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for unauthorized access attempts to router admin interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version against TP-Link security advisory; test with known exploit if authorizedCheck Version:
Log into router web interface > Status > Firmware Version or System Tools > Firmware UpgradeVerify Fix Applied:
Verify firmware version is patched; attempt exploitation (with authorization) to confirm failure📡 Detection & Monitoring
Log Indicators:
- Unusual admin login attempts
- Firmware modification logs
- Configuration change logs without authorized user
Network Indicators:
- HTTP requests to router admin interface from unexpected sources
- Traffic patterns suggesting router compromise
SIEM Query:
source_ip=external AND dest_ip=router_ip AND (uri_contains="admin" OR uri_contains="login" OR uri_contains="password")🔗 References
- http://packetstormsecurity.com/files/163274/TP-Link-TL-WR841N-Command-Injection.html
- https://pastebin.com/F8AuUdck
- https://static.tp-link.com/2020/202012/20201214/wa901ndv5_eu_3_16_9_up_boot%28201211%29.zip
- https://www.tp-link.com/us/security
- http://packetstormsecurity.com/files/163274/TP-Link-TL-WR841N-Command-Injection.html
- https://pastebin.com/F8AuUdck
- https://static.tp-link.com/2020/202012/20201214/wa901ndv5_eu_3_16_9_up_boot%28201211%29.zip
- https://www.tp-link.com/us/security
