CVE-2022-46910

Vulnerability

The firmware update process in TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 does not properly verify the integrity of uploaded firmware images. The firmware image structure includes headers containing MD5 checksums, but an attacker can craft a malicious image that bypasses this verification [2]. The vulnerability is present in the upgradeFirmware function, which computes checksums and compares them against the values in the image headers; however, the checks are insufficient to prevent a tampered image from being accepted [2].

Exploitation

An attacker can exploit this vulnerability during a firmware update by replacing the legitimate firmware image uploaded by an administrator with a specially crafted malicious image. This requires the attacker to have network access to intercept or modify the firmware upload (e.g., man-in-the-middle position) or to trick the administrator into directly uploading the malicious file via the device's web interface [2]. No authentication beyond the administrator's session for the firmware update is required; the attacker does not need prior authenticated access to the device if they can control the upload path [2].

Impact

Successful exploitation allows an attacker to install arbitrary firmware, leading to either denial-of-service (DoS) by corrupting the device, or execution of malicious code (including backdoors or malware) at the privilege level of the system firmware [2]. This compromises the confidentiality, integrity, and availability of the device and potentially the network it serves [2].

Mitigation

TP-Link has not publicly released a security advisory with a fixed firmware version as of the publication date [1]. Users are advised to check the TP-Link security advisory page for updates [1]. Until a patch is available, mitigating this risk includes restricting network access to the device's management interface, using strong passwords, and only performing firmware updates over trusted networks [2].