CVE-2022-24972
📋 TL;DR
CVE-2022-24972 is an authentication bypass vulnerability in TP-Link TL-WR940N routers that allows network-adjacent attackers to access stored credentials without authentication. The flaw exists in the httpd service on port 80 due to improper access control. This affects users of TP-Link TL-WR940N routers with vulnerable firmware versions.
💻 Affected Systems
- TP-Link TL-WR940N
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the router, change configurations, intercept network traffic, and potentially pivot to other devices on the network.
Likely Case
Attackers steal router credentials, gain administrative access, and modify network settings or DNS configurations.
If Mitigated
Attackers can still probe the service but cannot access sensitive information due to proper network segmentation and access controls.
🎯 Exploit Status
Exploitation requires network adjacency; no authentication needed; simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check TP-Link for latest firmware updates
Vendor Advisory: https://www.tp-link.com/us/support/download/tl-wr940n/
Restart Required: Yes
Instructions:
1. Log into router admin interface. 2. Navigate to System Tools > Firmware Upgrade. 3. Download latest firmware from TP-Link website. 4. Upload and install firmware. 5. Router will reboot automatically.
🔧 Temporary Workarounds
Disable Remote Management
allPrevents external access to router admin interface
Change Default Admin Credentials
allMitigates impact if credentials are exposed
🧯 If You Can't Patch
- Isolate router on separate VLAN to limit network access
- Implement network monitoring for suspicious HTTP requests to router IP
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface under System Tools > Firmware UpgradeCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify firmware version matches latest available from TP-Link website📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to router IP on port 80
- Multiple failed login attempts followed by successful access
Network Indicators:
- HTTP requests to router admin pages from unexpected internal IPs
- Traffic patterns suggesting credential harvesting
SIEM Query:
source_ip IN (internal_range) AND dest_ip = router_ip AND dest_port = 80 AND (uri CONTAINS 'login' OR uri CONTAINS 'admin')