PT-2021-7035
CVE-2021-35003
·
تاريخ النشر
2021-09-16
·
تاريخ التحديث
2022-01-27
الوصف من
CVSS 3.1
10
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
TP-Link Archer C90 version 1.0.6 Build 20200114 rel.73164(5553)
Description
This issue allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer C90 routers. Authentication is not required to exploit this issue. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length, stack-based buffer. An attacker can leverage this issue to execute code in the context of root.
Recommendations
For TP-Link Archer C90 version 1.0.6 Build 20200114 rel.73164(5553), as a temporary workaround, consider restricting access to the DNS response handling mechanism until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾