CVE-2023-46522

Vulnerability

A stack overflow vulnerability exists in the deviceInfoRegister function of the web interface in TP-LINK TL-WR886N V7.0 (firmware version 3.0.14_Build_221115_Rel.56908n.bin) and TL-WDR7660 (firmware version 2.0.30). The flaw is triggered when processing a specially crafted HTTP request, overwhelming the stack buffer without proper bounds checking.

Exploitation

An attacker with network access to the affected router can send a maliciously crafted request to the deviceInfoRegister endpoint. The proof-of-concept code is publicly available [1], demonstrating the exact payload required to overwrite the stack and hijack execution flow.

Impact

Successful exploitation yields arbitrary code execution with root privileges, giving the attacker full control over the device. This includes the ability to modify network traffic, exfiltrate data, and pivot to internal networks.

Mitigation

As of the publication date (2023-10-25), no official firmware update has been released to address this vulnerability. Users are advised to restrict remote administration to trusted networks and monitor official TP-LINK security advisories. The affected devices may be approaching or past end-of-life, making a patch unlikely.