Security Risks in TP-Link Archer Router Could Lead to Unauthorized Access – Source:cyble.com

Overview

The TP-Link Archer C50 V4, a popular dual-band wireless router designed for small office and home office (SOHO) networks, has been found to contain multiple security vulnerabilities that could expose users to a range of cyber threats.

These TP-Link Archer router vulnerabilities, identified under the CVE-2024-54126 and CVE-2024-54127 identifiers, affect all firmware versions prior to Archer C50(EU)_V4_240917. The Indian Computer Emergency Response Team (CERT-In) flagged these vulnerabilities and the security of TP-Link Archer routers.

The vulnerabilities identified in the TP-Link Archer C50 V4 wireless router could allow attackers to exploit critical security holes in the device, leading to unauthorized access and potentially damaging consequences. Two specific issues have been highlighted: a flaw in the firmware upgrade process and the exposure of sensitive Wi-Fi credentials.

Details of the TP-Link Archer Router Vulnerabilities

The TP-Link Archer router vulnerabilities have been classified as medium risk. While the immediate impact may not be critical, the potential for exploitation remains a threat to network security. CVE-2024-54126 and CVE-2024-54127 were reported by Khalid Markar, Amey Chavekar, Sushant Mane, and Dr. Faruk Kazi from CoE-CNDS Lab, VJTI, Mumbai.

Vulnerability Details in TP-Link Archer Router

1. Insufficient Integrity Verification During Firmware Upgrade (CVE-2024-54126)

One of the key vulnerabilities in the TP-Link Archer C50 router arises from an improper signature verification mechanism in the firmware upgrade process. This issue is present in the web interface of the router, which could be exploited by an attacker with administrative privileges. If the attacker is within the Wi-Fi range of the router, they could upload and execute malicious firmware, allowing them to compromise the device completely.

The absence of adequate integrity checks during firmware updates could enable an attacker to introduce backdoors or malicious code into the router. This would allow the attacker to control the device, manipulate network traffic, or even hijack the entire system, posing a serious security risk for users relying on this router for their home or business networks.

• Exposure of Wi-Fi Credentials in Plaintext (CVE-2024-54127)

The second vulnerability is related to the lack of proper access control on the serial interface of the TP-Link Archer C50 router. An attacker with physical access to the device could exploit this weakness by accessing the Universal Asynchronous Receiver-Transmitter (UART) shell. Once inside, the attacker could easily extract Wi-Fi credentials, including the network name (SSID) and password, which would give them unauthorized access to the targeted network.

This vulnerability in TP-Link Archer routers is particularly malicious because obtaining Wi-Fi credentials allows attackers to infiltrate the network, potentially exposing sensitive data, intercepting communications, or launching further attacks on connected devices. The ability to obtain such information without the need for remote access makes this vulnerability especially dangerous in situations where physical access to the device is possible.

Impact of the TP-Link Archer Vulnerability

The presence of these vulnerabilities in the TP-Link Archer C50 V4 router could lead to significant security risks, including:

• Compromise of the router: Malicious firmware uploads could enable attackers to control the device, potentially disrupting network operations or using it as a platform for launching further attacks.
• Exposure of sensitive information: The vulnerability related to the exposure of Wi-Fi credentials allows attackers to access the network and all connected devices. This could lead to data breaches, unauthorized surveillance, and even identity theft.
• Potential system compromise: Once the attacker gains access to the router or the Wi-Fi network, they may leverage this foothold to exploit other vulnerabilities in the network infrastructure, leading to a larger-scale attack.

Given that many home and small office networks rely on TP-Link Archer routers for wireless connectivity, these vulnerabilities have the potential to affect a large number of users. The impact could be particularly severe for businesses or individuals who store sensitive information or rely on secure communications.

Mitigating the Vulnerability in TP-Link Archer Router

To mitigate the risks associated with these vulnerabilities, TP-Link has released a firmware update designed to address the issues. The solution is available for download through the official TP-Link website and should be applied as soon as possible to protect the router from potential attacks. Some of the recommended actions include:

• Update Firmware: Users of the TP-Link Archer C50 V4 router are advised to upgrade to the latest firmware version, Archer C50(EU)_V4_240917. This update fixes the vulnerabilities by enhancing the integrity checks during the firmware upgrade process and securing access to the serial interface to prevent unauthorized access to Wi-Fi credentials.
• Firmware Upgrade Instructions: To ensure a smooth upgrade, users should follow the specific instructions provided by TP-Link, which include verifying the hardware version of the router, downloading the correct firmware, and ensuring the router is not powered off during the upgrade process. It is also recommended to use a wired connection during the upgrade to avoid any issues with wireless disconnections.

Conclusion

The discovery of vulnerabilities in the TP-Link Archer router highlights the critical need for users to stay updated with the latest firmware releases and security patches. The vulnerabilities in the TP-Link Archer C50 V4, including the insufficient integrity verification during firmware upgrades and the exposure of Wi-Fi credentials, present an ongoing security risks that could lead to unauthorized access and system compromise.

By upgrading to the latest firmware version, users can mitigate the risks associated with these vulnerabilities and protect their networks from potential exploitation. TP-Link Archer router users should take immediate action to secure their devices and ensure their networks remain safe from attackers seeking to exploit these flaws.

References

• https://www.cert-in.org.in/
• https://www.tp-link.com/en/support/download/archer-c50/v4/#Firmware
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54127
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54126

Related