TP-Link Archer C5400X gaming router is affected by a critical flaw

Researchers warn of a critical remote code execution vulnerability in TP-Link Archer C5400X gaming router.

Researchers at OneKey discovered a a critical remote code execution (RCE) vulnerability, tracked as CVE-2024-5035 (CVSS score 10.0), in TP-Link Archer C5400X gaming router.

A remote, unauthenticated, attacker can exploit the vulnerability to execute commands on the device.

The TP-Link Archer C5400X is a high-performance gaming router designed for demanding applications such as online gaming and streaming.

The vulnerability resides in a binary called “rftest” that is executed during device startup. The researchers discovered that the binary exposes a network service that is susceptible to unauthenticated command injection and buffer overflows on TCP ports 8888, 8889, and 8890

“By successfully exploiting this flaw, remote unauthenticated attacker can gain arbitrary command execution on the device with elevated privileges.” reads the report published by the OneKey. “It’s unclear whether the binary is always launched and whether it is always exposed on LAN/WAN interfaces. We reproduced the issue within an emulator, but production device may behave differently. We put our trust in TP-Link in assessing the actual exposure of this vulnerability.“

The experts noticed that upon executing the binary, it starts a TCP server on port 8888, accepting commands from clients. The binary only accepts commands starting with “wl” or “nvram get”. However, this limitation can be bypassed for command injection by appending shell meta-characters like “;”, “&”, or “|”.

TP-Link addressed the issue by discarding any command containing shell meta-characters.

The issue affects firmware versions, through 1.1.1.6, Archer C5400X(EU)_V1_1.1.7 Build 20240510 addressed the flaw.

Below is the timeline for this flaw:

• 2024-02-16 –Report submitted to TP-Link PSIRT through encrypted email.
• 2024-02-19 –Case opened by TP-Link PSIRT.
• 2024-04-10 –TP-Link shares a beta version of 1.1.7p1 for validation.
• 2024-04-17 –Patch confirmed by ONEKEY.
• 2024-05-27 –Release ONEKEY advisory in coordination with TP-Link

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, TP-Link Archer C5400X)