CVE-2018-20372

Vulnerability

A persistent cross-site scripting (XSS) vulnerability exists in the web-application of TP-Link TD-W8961ND ADSL2+ Modem Routers (firmware v1.x) and potentially other models using the same firmware [1]. The flaw resides in the DHCP client list view, where the hostname field from DHCP clients is not properly sanitized before being displayed. An attacker can inject arbitrary JavaScript code by setting a DHCP client's hostname to include malicious script payloads. The injected code executes on the application-side when the administrator views the DHCP client list in the web interface, resulting in stored XSS [1].

Exploitation

To exploit this vulnerability, an attacker must be on the same local network as the target router and have the ability to send DHCP requests [1]. No authentication is required to initiate the attack; the attacker's DHCP client simply needs to be configured (or spoof) a hostname containing an XSS payload (e.g., ``). When the router's web interface is accessed by an administrator, the DHCP client list renders the malicious hostname, executing the script in the context of the administrator's browser session [1]. The attack is remote, as the attacker can be any device on the LAN that obtains an IP via DHCP.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the administrator's browser [1]. This can lead to session hijacking, configuration changes, redirection to malicious sites, or further compromise of the router's administrative functions. The CVSS v2 score is 3.5 (Low), reflecting prerequisites of local network access and user interaction (the admin must view the DHCP client list) [1]. The impact is context-dependent, but in a home or small office environment, this could allow an attacker to modify DNS settings, exfiltrate credentials, or perform other administrative actions.

Mitigation

Vendor advisory or patch: Not disclosed in the available references [1]. As of the publication date (2016-11-28 disclosure, 2018-12-23 CVE assignment), no official firmware update from TP-Link has been mentioned. Users should restrict access to the router's web interface to trusted networks, disable remote management, and avoid viewing the DHCP client list when untrusted devices are connected. Additionally, network-level controls like ingress filtering for DHCP hostnames could help, but no official workaround is documented.