CVE-2018-17017

Vulnerability

The vulnerability resides in the DHCP daemon (dhcpd) of TP-Link TL-WR886N devices, specifically in firmware versions 2.3.4 for hardware version 6.0 and 1.1.0 for hardware version 7.0 [1]. By sending an HTTP POST request with an excessively long value in a specific JSON key used for DHCP configuration, an attacker can cause a buffer overflow that corrupts the dhcpd configuration file, leading to a crash of the inetd task and subsequently affecting HTTP, DNS, and UPnP services [1].

Exploitation

An attacker must be authenticated to the router's web interface [1]. The attacker crafts a POST request to the DHCP configuration endpoint with a JSON payload containing a very long string for the relevant key. This triggers the overflow when the router processes the data and writes it to the configuration file [1]. The proof-of-concept code demonstrates the authentication process and the ability to send arbitrary JSON, though the specific exploit payload is not fully detailed [1]. No additional privileges or network position beyond authenticated access are required.

Impact

Successful exploitation crashes the inetd task, which stops several critical network services, including the web server (HTTP), DNS resolver, and UPnP daemon [1]. This results in a denial-of-service (DoS) condition, effectively rendering the router's management interface and some network functions unavailable until a reboot [1]. No code execution or data exfiltration is reported.

Mitigation

As of the publication date (2018-09-13), no official firmware update addressing this vulnerability has been released by TP-Link [1]. The affected models (TL-WR886N v6.0 and v7.0) may be nearing or at end-of-life, and no workaround is documented [1]. Users should consider upgrading to a supported router model if continued security is required.