CVE-2022-22922
📋 TL;DR
This vulnerability in TP-Link TL-WA850RE Wi-Fi range extenders allows attackers to gain administrative access by exploiting predictable session keys. Attackers can take full control of affected devices, potentially compromising connected networks. Users with TL-WA850RE range extenders running firmware versions before v6_200923 are affected.
💻 Affected Systems
- TP-Link TL-WA850RE Wi-Fi Range Extender
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network compromise where attackers gain administrative control, intercept all traffic, deploy malware to connected devices, and use the device as a pivot point for further attacks.
Likely Case
Unauthorized administrative access to the range extender allowing attackers to change settings, monitor network traffic, and potentially access connected devices.
If Mitigated
Limited impact if device is isolated from critical systems and regularly monitored for unauthorized configuration changes.
🎯 Exploit Status
The vulnerability involves predictable session keys that can be easily calculated or brute-forced by attackers with physical proximity to the wireless network.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v6_200923 and later
Vendor Advisory: https://www.tp-link.com/us/support/download/tl-wa850re/v6/#Firmware
Restart Required: Yes
Instructions:
1. Visit TP-Link support page for TL-WA850RE v6. 2. Download firmware version v6_200923 or later. 3. Log into range extender web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install the new firmware. 6. Device will reboot automatically.
🔧 Temporary Workarounds
Network Isolation
allPlace the range extender on a separate VLAN or network segment to limit potential damage if compromised.
Disable Remote Management
allDisable any remote management features and ensure the web interface is only accessible from trusted networks.
🧯 If You Can't Patch
- Replace the device with a newer model or different vendor product that is not vulnerable
- Disable the range extender entirely and use alternative networking solutions
🔍 How to Verify
Check if Vulnerable:
Access the range extender web interface, navigate to System Tools > Firmware Upgrade, and check the current firmware version.Check Version:
No CLI command available - check via web interface at http://tplinkrepeater.net or device IP addressVerify Fix Applied:
After updating, verify the firmware version shows v6_200923 or later in the System Tools > Firmware Upgrade page.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login from unexpected IP/MAC addresses
- Configuration changes made from unauthorized sources
Network Indicators:
- Unusual administrative traffic to range extender management interface
- Changes to wireless network settings without authorization
SIEM Query:
source="range_extender_logs" AND (event_type="login_success" OR event_type="config_change") AND user_agent NOT IN ("trusted_user_agents")