CVE-2018-17014

Vulnerability

A buffer overflow vulnerability exists in the ipMacBind module of TP-Link TL-WR886N firmware versions 6.0 2.3.4 and 7.0 1.1.0. The module parses JSON data for ip_mac_bind name parameters without proper length validation. Sending a request with an extremely long value in the name key causes the module to overflow its buffer, corrupting the config file and potentially crashing the inetd task [1].

Exploitation

An attacker must be authenticated to the router's web interface. Using a crafted HTTP POST request to the login endpoint with a long JSON string in the ip_mac_bind name field, the attacker can trigger the overflow. The provided proof-of-concept demonstrates how to obtain a session token and then send the malicious payload [1]. The attack can be carried out remotely as long as the attacker has valid credentials.

Impact

Successful exploitation crashes the inetd daemon, which stops critical network services such as HTTP (web interface), DNS, and UPnP. This results in a denial of service condition for all router functions relying on these services, effectively rendering the device unusable until a reboot [1]. No privilege escalation or data leakage is achieved; the impact is limited to availability.

Mitigation

As of the publication date (2018-09-13), no firmware update was available from TP-Link to address this vulnerability. Users are advised to restrict access to the router administration interface and monitor for firmware updates from the vendor. The vulnerable device models may be considered end-of-life (EOL), so replacement with a supported model is recommended.