CVE-2021-44827

Vulnerability

The TP-Link Archer C20i router running firmware version 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n or older is vulnerable to authenticated OS command injection. The vulnerability resides in the web interface's network configuration management, specifically within the X_TP_ExternalIPv6Address HTTP parameter [2]. An attacker with valid administrative credentials can inject arbitrary OS commands into this parameter, which are then executed by the device without proper sanitization [1].

Exploitation

Exploitation requires an authenticated session with administrator-level access to the router's web interface. The attacker sends a crafted POST request to the /cgi?2&2 endpoint, embedding the malicious command in the X_TP_ExternalIPv6Address field. For example, injecting &telnetd -p 1024 -l sh& starts a telnet daemon on TCP port 1024 with a root shell accessible without a password [2]. The attack relies on the default web interface being accessible on the local network or a WAN-facing management interface [1].

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands with root privileges on the router. This grants full control over the device, enabling activities such as modifying network configurations, intercepting or redirecting traffic, installing persistent backdoors, or leveraging the router as a pivot point for further network attacks [2].

Mitigation

TP-Link provides a firmware update to address this vulnerability. The latest firmware version for the Archer C20i is available on the TP-Link support download page [2]. Users should update their device firmware immediately. If updating is not possible, restricting administrative web interface access to trusted IP addresses and disabling remote management are recommended workarounds [1]. The device is end-of-life (EOL) and may not receive further updates; users are advised to consider replacing it with a supported model [2].