Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
A command
injection vulnerability has been identified in the DHCP option processing logic
in multiple TP-Link router models, due to insufficient validation of externally
supplied DHCP option data. An adjacent attacker may exploit this
vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized
command execution during device initialization or provisioning workflows. This
typically occurs when the device is in a factory-default or unconfigured state.
Successful
exploitation may allow an adjacent, unauthenticated attacker to execute
arbitrary commands with elevated privileges, potentially leading to full
compromise of the affected device and unauthorized administrative control.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Archer MR200 v07
Vendor
TP-Link Systems Inc.
Product
Archer MR200 v07
Platforms
Unknown
Default status
unaffected
Archer MR200 v07 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.3.0 Build 250605
Unavailable
None listed
Archer MR200 v8
Vendor
TP-Link Systems Inc.
Product
Archer MR200 v8
Platforms
Unknown
Default status
unaffected
Archer MR200 v8 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.5.0 Build 260605
Unavailable
None listed
Archer MR402 v1
Vendor
TP Link Systems Inc.
Product
Archer MR402 v1
Platforms
Unknown
Default status
unaffected
Archer MR402 v1 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
1.5.0 Build 260605
Unavailable
None listed
Archer VR2100 v1
Vendor
TP-Link Systems Inc.
Product
Archer VR2100 v1
Platforms
Unknown
Default status
unaffected
Archer VR2100 v1 · Scoped product and version facts