CVE-2018-17010

Vulnerability

An issue was discovered on TP-Link TL-WR886N firmware versions 6.0 2.3.4 (hardware 6.0) and 1.1.0 (hardware 7.0) [1]. The vulnerability resides in the wireless configuration module, where a crafted HTTP POST request containing an excessively long JSON value for the wlan_host_2g bandwidth parameter can cause a buffer overflow when the wireless module saves data to the config file [1]. This overflow corrupts memory and eventually crashes the inetd task, which halts network services such as HTTP, DNS, and UPnP [1].

Exploitation

An attacker must first obtain valid authentication credentials to the router's web interface. Once authenticated, the attacker sends a POST request to the wireless configuration endpoint with a JSON payload where the value of the wlan_host_2g bandwidth key is a long string (e.g., many characters in the POC). The specific length required to trigger the overflow is not publicly detailed but the provided exploit demonstrates that a sufficiently long string, as generated by the POC script, causes the crash [1]. No other special network position is needed beyond access to the LAN or WAN interface where the router's web server is reachable [1].

Impact

Successful exploitation crashes the inetd task, which is responsible for launching essential network services including the HTTP web server, DNS, and UPnP [1]. This results in a denial of service (DoS) affecting the router's management interface and network services, requiring a physical reboot to restore normal operation [1]. No code execution or privilege escalation has been reported [1].

Mitigation

As of the publication date (2018-09-13) and the available references, TP-Link has not released a patched firmware version for either affected model [1]. Users should consider upgrading to a newer hardware revision or firmware version if available, or restrict LAN access to only trusted users to limit the attack surface. The device is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog [1].