CVE-2023-39747
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected TP-Link wireless routers via a buffer overflow in the radiusSecret parameter. Attackers can exploit this without authentication to gain full control of the device. Users of TP-Link WR841N V8, TL-WR940N V2, and TL-WR941ND V5 routers are affected.
💻 Affected Systems
- TP-Link WR841N V8
- TP-Link TL-WR940N V2
- TP-Link TL-WR941ND V5
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent backdoor installation, network traffic interception, credential theft, and lateral movement to connected devices.
Likely Case
Router takeover enabling DNS hijacking, man-in-the-middle attacks, and botnet recruitment.
If Mitigated
Limited impact if routers are behind firewalls with strict inbound filtering, though internal network compromise remains possible.
🎯 Exploit Status
Public proof-of-concept code exists in GitHub repositories. Exploitation requires sending crafted HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check TP-Link support for latest firmware
Vendor Advisory: https://www.tp-link.com/support/download/
Restart Required: Yes
Instructions:
1. Visit TP-Link support website. 2. Download latest firmware for your specific model. 3. Log into router web interface. 4. Navigate to System Tools > Firmware Upgrade. 5. Upload and install new firmware. 6. Reboot router.
🔧 Temporary Workarounds
Disable Remote Management
allPrevent external access to router web interface
Network Segmentation
allPlace routers in isolated network segment with strict firewall rules
🧯 If You Can't Patch
- Replace affected routers with supported models
- Implement strict network access controls to limit exposure to router management interface
🔍 How to Verify
Check if Vulnerable:
Check router model and firmware version via web interface at 192.168.0.1 or 192.168.1.1Check Version:
curl -s http://router-ip/userRpm/LoginRpm.htm | grep -i versionVerify Fix Applied:
Verify firmware version has been updated to latest available from TP-Link📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP POST requests to /userRpm/WlanSecurityRpm
- Large radiusSecret parameter values in web logs
Network Indicators:
- Unexpected outbound connections from router
- DNS query anomalies
- Port scanning originating from router
SIEM Query:
source="router_logs" AND uri="/userRpm/WlanSecurityRpm" AND (param="radiusSecret" AND length(value)>100)🔗 References
- https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/17/TP-Link%20WR841N%20wireless%20router%20WlanSecurityRpm%20Stack%20Overflow%20vulnerability.md
- https://github.com/a101e-IoTvul/iotvul/blob/main/tp-link/17/TP-Link%20WR841N%20wireless%20router%20WlanSecurityRpm%20Stack%20Overflow%20vulnerability.md
