CVE-2021-35003
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code as root on TP-Link Archer C90 routers without authentication. Attackers can exploit a stack-based buffer overflow in DNS response handling by sending crafted DNS messages. All users of affected TP-Link Archer C90 routers with vulnerable firmware are at risk.
💻 Affected Systems
- TP-Link Archer C90
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise with root-level code execution, allowing attackers to intercept traffic, modify configurations, install persistent malware, and pivot to internal networks.
Likely Case
Router takeover leading to DNS hijacking, credential theft, man-in-the-middle attacks, and network surveillance.
If Mitigated
Limited impact if router is behind firewall with restricted DNS access, though still vulnerable to internal threats.
🎯 Exploit Status
ZDI published details and proof-of-concept. The vulnerability requires sending crafted DNS responses to the router, which attackers can achieve through DNS poisoning or man-in-the-middle attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later firmware versions (check TP-Link support site)
Vendor Advisory: https://www.tp-link.com/us/support/download/archer-c90/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from TP-Link website. 4. Upload and install firmware. 5. Reboot router.
🔧 Temporary Workarounds
Disable router DNS resolver
allConfigure router to use external DNS servers instead of its internal resolver
Router admin: Network > DHCP Server > Primary/Secondary DNS (set to 8.8.8.8, 1.1.1.1, etc.)
Restrict DNS access
allUse firewall rules to block external DNS queries to router
Router admin: Security > Firewall > Add rule blocking UDP/TCP port 53 from WAN
🧯 If You Can't Patch
- Replace vulnerable router with updated model or different vendor
- Place router behind dedicated firewall with strict DNS filtering
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface: System Tools > Firmware UpgradeCheck Version:
Router admin: System Tools > Firmware Upgrade shows current versionVerify Fix Applied:
Verify firmware version is newer than 1.0.6 Build 20200114 rel.73164(5553)📡 Detection & Monitoring
Log Indicators:
- Unusual DNS response patterns
- Router crash/reboot logs
- Failed firmware update attempts
Network Indicators:
- Malformed DNS packets to router port 53
- Unusual outbound connections from router
SIEM Query:
source="router" AND (dns.response.malformed OR port=53 AND size>512)