CVE-2018-17004

Vulnerability

An issue exists in the TP-Link TL-WR886N router firmware versions 6.0 2.3.4 and 7.0 1.1.0. The wlan_access module, which manages the wireless access control list, accepts HTTP POST requests to add entries. When a request contains an overly long string value for the JSON key that specifies the access list name, a buffer overflow corrupts the module's configuration file. If the string is long enough, the overflow can crash the inetd task, which is responsible for managing critical network services such as HTTP, DNS, and UPnP [1].

Exploitation

An attacker must first authenticate to the router's web interface (e.g., with the administrator password). The attacker then sends a crafted HTTP POST request to the router's endpoint that handles wlan_access white list additions, including a JSON key-value pair where the value is an abnormally long string. The provided proof-of-concept code demonstrates sending such a request to trigger the overflow [1]. No user interaction beyond the attacker's own actions is required.

Impact

Successful exploitation causes the inetd daemon to crash, which halts multiple network services including the HTTP administration interface, DNS resolution, and UPnP functionality. This results in a denial-of-service (DoS) condition that persists until the router is rebooted. The crash does not lead to code execution or data theft, but it renders the router's management interface and some network services temporarily unavailable [1].

Mitigation

TP-Link has not released a patched firmware version as of the publication date (2018-09-13). The only known mitigation is to restrict administrative access to the router's web interface to trusted users and networks, or to upgrade to a later hardware/firmware revision if available. There is no workaround that does not involve modifying the firmware binary. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing [1].