blackbox-fuzzing

Fuzzing de caja negra de dispositivos IoT usando el router TL-WR902AC como ejemplo Esta es la versión HTML de mi trabajo académico, que se puede descargar como PDF aquí. Introducción El fuzzing se ha convertido en "una de las formas más eficaces" de encontrar errores en el software. Con esta o...

internet-of-vulnerable-things

Internet de las Cosas Vulnerables Los resultados de mi pequeño trabajo de investigación sobre el tema de Internet de las Cosas Vulnerables. Resumen Este artículo proporciona una demostración práctica de lo inseguro que es Internet de las Cosas hackeando un dispositivo IoT típico. Se identificaron...

CVE-2026-12001: Use of Hard-coded Credentials

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5. Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through...

CVE-2022-48194

TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service DoS by uploading a crafted firmware update because the signature check is inadequate...

CVE-2023-50225

TP-Link TL-WR902AC dmfillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability. The...

CVE-2023-44447

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. Th...

CVE-2023-50225 TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability

TP-Link TL-WR902AC dmfillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability. The...

CVE-2023-50225 TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability

TP-Link TL-WR902AC dmfillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability. The...

CVE-2023-44447

CVE-2023-44447 affects TP-Link TL-WR902AC. The vulnerability is in the httpd service listening on TCP port 80 and stems from improper authentication, allowing network-adjacent attackers to disclose stored credentials and potentially further compromise. Connected sources (ZDI advisory ZDI-23-1623 ...

CVE-2023-44447 TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. Th...

CVE-2023-44447 TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. Th...

CVE-2023-50225: Stack-based Buffer Overflow

TP-Link TL-WR902AC dmfillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability. The...

CVE-2023-44447: Authentication Bypass by Spoofing

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. Th...

The vulnerability of the dm_fillObjByStr function in TP-Link TL-WR902AC router software arises due to overflow of buffers on the stack, allowing an attacker to execute arbitrary code.

The vulnerability of the dmfillObjByStr function in the microprogramming software of TP-Link’s router TL-WR902AC is caused by an overflow in the buffer on the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

TP-Link TL-WR902AC dm_fillObjByStr Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the libcmm.so module. The issue results from the lack of proper...

TP-Link TL-WR902AC loginFs Improper Authentication Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR902AC routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default...

CVE-2023-36489

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR802N firmware versions prior to 'TL-WR802NJPV4221008', TL-WR841N firmware versions prior to 'TL-WR841NJPV14230506', and TL-WR902AC firmware...

CVE-2023-36489

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR802N firmware versions prior to 'TL-WR802NJPV4221008', TL-WR841N firmware versions prior to 'TL-WR841NJPV14230506', and TL-WR902AC firmware...

CVE-2023-36489: Improper Neutralization of Special Elements used in an OS Command

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: TL-WR802N firmware versions prior to 'TL-WR802NJPV4221008', TL-WR841N firmware versions prior to 'TL-WR841NJPV14230506', and TL-WR902AC firmware...

PT-2023-7976 · Tp Link · Tp-Link Tl-Wr902Ac

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR902AC affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR902AC routers. Authentication is required to exploit this issue...