CVE-2021-29302
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected TP-Link routers via a buffer overflow in the HTTP daemon. Attackers can gain shell access to the router by sending specially crafted network messages. This affects TP-Link TL-WR802N(US) and Archer_C50v5_US routers with vulnerable firmware versions.
💻 Affected Systems
- TP-Link TL-WR802N(US)
- TP-Link Archer_C50v5_US
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router with persistent backdoor installation, network traffic interception, credential theft, and pivot to internal network devices.
Likely Case
Router takeover leading to DNS hijacking, network disruption, and credential harvesting from connected devices.
If Mitigated
Limited impact with proper network segmentation and firewall rules preventing external access to router admin interface.
🎯 Exploit Status
Exploit code available in public repositories, requires network access to router HTTP interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TL-WR802Nv4_US_0.9.1_3.17_up_boot[210317-rel64474] or later
Vendor Advisory: https://www.tp-link.com/us/support/download/tl-wr802n/#Firmware
Restart Required: Yes
Instructions:
1. Download latest firmware from TP-Link support site. 2. Log into router admin interface. 3. Navigate to System Tools > Firmware Upgrade. 4. Upload firmware file. 5. Wait for automatic reboot.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Login to router admin > Advanced > System Tools > Administration > Disable 'Remote Management'
Restrict Admin Interface Access
allLimit admin interface to specific IP addresses
Login to router admin > Advanced > Security > Access Control > Set allowed IP ranges
🧯 If You Can't Patch
- Place router behind firewall with strict inbound rules blocking all external access to router management ports (80, 443, 8080)
- Implement network segmentation to isolate router management interface from user networks
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface under System Tools > Firmware Upgrade. Compare with vulnerable version range.Check Version:
curl -s http://router-ip/ | grep -i firmware || login to web interfaceVerify Fix Applied:
Verify firmware version matches or exceeds TL-WR802Nv4_US_0.9.1_3.17_up_boot[210317-rel64474]📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to router admin interface
- Multiple failed login attempts followed by buffer overflow patterns
- Unexpected process creation (httpd spawning shells)
Network Indicators:
- Unusual HTTP POST requests with oversized payloads to router IP
- Traffic patterns suggesting reverse shell connections from router
SIEM Query:
source="router-logs" AND (http_request_size>10000 OR process="sh" OR process="bash")🔗 References
- https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-29302
- https://static.tp-link.com/beta/2021/202103/20210319/TL-WR802Nv4_US_0.9.1_3.17_up_boot%5B210317-rel64474%5D.zip
- https://www.tp-link.com/us/support/download/tl-wr802n/#Firmware
- https://github.com/liyansong2018/CVE/tree/main/2021/CVE-2021-29302
- https://static.tp-link.com/beta/2021/202103/20210319/TL-WR802Nv4_US_0.9.1_3.17_up_boot%5B210317-rel64474%5D.zip
- https://www.tp-link.com/us/support/download/tl-wr802n/#Firmware
