Search
Find a vulnerability
Search criteria
10 vulnerabilities found for ax1800_firmware by mi
CVE-2023-27346 (GCVE-0-2023-27346)
Vulnerability from nvd – Published: 2024-05-03 01:56 – Updated: 2024-09-18 18:28
VLAI
EPSS
VEX
Title
TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19703.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-16 19:02 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link | AX1800 |
Affected:
Archer AX21(US)_V3_1.1.1 Build 20220603
|
|
| mi | ax1800_firmware |
Affected:
0 , < 3230219
(custom)
cpe:2.3:o:mi:ax1800_firmware:-:*:*:*:*:*:*:* |
Date Public
2023-03-31 20:45
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:mi:ax1800_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "mi",
"versions": [
{
"lessThan": "3230219",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T19:02:06.476318Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T15:33:40.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:09:43.399Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-377",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-377/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AX1800",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "Archer AX21(US)_V3_1.1.1 Build 20220603"
}
]
}
],
"dateAssigned": "2023-02-28T18:05:54.014Z",
"datePublic": "2023-03-31T20:45:32.764Z",
"descriptions": [
{
"lang": "en",
"value": "TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-19703."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T18:28:03.839Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-377",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-377/"
}
],
"source": {
"lang": "en",
"value": "Kevin Wang"
},
"title": "TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-27346",
"datePublished": "2024-05-03T01:56:05.862Z",
"dateReserved": "2023-02-28T17:58:45.480Z",
"dateUpdated": "2024-09-18T18:28:03.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14099 (GCVE-0-2020-14099)
Vulnerability from nvd – Published: 2021-04-08 17:52 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi Router AX1800,Xiaomi Rourer RM1800 |
Affected:
Xiaomi Router AX1800 rom version < 1.0.336, Xiaomi Router RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:36.163Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi Router AX1800,Xiaomi Rourer RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi Router AX1800 rom version \u003c 1.0.336, Xiaomi Router RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On Xiaomi router AX1800 rom version \u003c 1.0.336 and RM1800 root version \u003c 1.0.26, the encryption scheme for a user\u0027s backup files uses hard-coded keys, which can expose sensitive information such as a user\u0027s password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-08T17:52:45.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14099",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi Router AX1800,Xiaomi Rourer RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi Router AX1800 rom version \u003c 1.0.336, Xiaomi Router RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "On Xiaomi router AX1800 rom version \u003c 1.0.336 and RM1800 root version \u003c 1.0.26, the encryption scheme for a user\u0027s backup files uses hard-coded keys, which can expose sensitive information such as a user\u0027s password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14099",
"datePublished": "2021-04-08T17:52:45.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:36.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14102 (GCVE-0-2020-14102)
Vulnerability from nvd – Published: 2021-01-13 22:33 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Severity
No CVSS data available.
CWE
- command injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi router AX1800 |
Affected:
Xiaomi router AX1800rom version < 1.0.336
|
|
| n/a | Xiaomi route RM1800 |
Affected:
Xiaomi route RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:35.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi router AX1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
},
{
"product": "Xiaomi route RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T22:33:05.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14102",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi router AX1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
}
},
{
"product_name": "Xiaomi route RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "command injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14102",
"datePublished": "2021-01-13T22:33:05.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:35.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14101 (GCVE-0-2020-14101)
Vulnerability from nvd – Published: 2021-01-13 22:25 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Severity
No CVSS data available.
CWE
- Information leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi router AX1800 |
Affected:
Xiaomi router AX1800rom version < 1.0.336
|
|
| n/a | Xiaomi route RM1800 |
Affected:
Xiaomi route RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:35.663Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi router AX1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
},
{
"product": "Xiaomi route RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T22:25:07.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14101",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi router AX1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
}
},
{
"product_name": "Xiaomi route RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14101",
"datePublished": "2021-01-13T22:25:07.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:35.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14098 (GCVE-0-2020-14098)
Vulnerability from nvd – Published: 2021-01-13 22:30 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Severity
No CVSS data available.
CWE
- Authentication bypass
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi router AX1800 |
Affected:
Xiaomi router AX1800rom version < 1.0.336
|
|
| n/a | Xiaomi route RM1800 |
Affected:
Xiaomi route RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:35.729Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi router AX1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
},
{
"product": "Xiaomi route RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Authentication bypass",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T22:30:41.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14098",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi router AX1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
}
},
{
"product_name": "Xiaomi route RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Authentication bypass"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14098",
"datePublished": "2021-01-13T22:30:41.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:35.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-27346 (GCVE-0-2023-27346)
Vulnerability from cvelistv5 – Published: 2024-05-03 01:56 – Updated: 2024-09-18 18:28
VLAI
EPSS
VEX
Title
TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Summary
TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.
. Was ZDI-CAN-19703.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-16 19:02 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-… | x_research-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| TP-Link | AX1800 |
Affected:
Archer AX21(US)_V3_1.1.1 Build 20220603
|
|
| mi | ax1800_firmware |
Affected:
0 , < 3230219
(custom)
cpe:2.3:o:mi:ax1800_firmware:-:*:*:*:*:*:*:* |
Date Public
2023-03-31 20:45
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:mi:ax1800_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ax1800_firmware",
"vendor": "mi",
"versions": [
{
"lessThan": "3230219",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-27346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-16T19:02:06.476318Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-25T15:33:40.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T12:09:43.399Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ZDI-23-377",
"tags": [
"x_research-advisory",
"x_transferred"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-377/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "AX1800",
"vendor": "TP-Link",
"versions": [
{
"status": "affected",
"version": "Archer AX21(US)_V3_1.1.1 Build 20220603"
}
]
}
],
"dateAssigned": "2023-02-28T18:05:54.014Z",
"datePublic": "2023-03-31T20:45:32.764Z",
"descriptions": [
{
"lang": "en",
"value": "TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AX1800 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the parsing of firmware images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\n. Was ZDI-CAN-19703."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-18T18:28:03.839Z",
"orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"shortName": "zdi"
},
"references": [
{
"name": "ZDI-23-377",
"tags": [
"x_research-advisory"
],
"url": "https://www.zerodayinitiative.com/advisories/ZDI-23-377/"
}
],
"source": {
"lang": "en",
"value": "Kevin Wang"
},
"title": "TP-Link AX1800 Firmware Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
"assignerShortName": "zdi",
"cveId": "CVE-2023-27346",
"datePublished": "2024-05-03T01:56:05.862Z",
"dateReserved": "2023-02-28T17:58:45.480Z",
"dateUpdated": "2024-09-18T18:28:03.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14099 (GCVE-0-2020-14099)
Vulnerability from cvelistv5 – Published: 2021-04-08 17:52 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
On Xiaomi router AX1800 rom version < 1.0.336 and RM1800 root version < 1.0.26, the encryption scheme for a user's backup files uses hard-coded keys, which can expose sensitive information such as a user's password.
Severity
No CVSS data available.
CWE
- Information disclosure
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi Router AX1800,Xiaomi Rourer RM1800 |
Affected:
Xiaomi Router AX1800 rom version < 1.0.336, Xiaomi Router RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:36.163Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi Router AX1800,Xiaomi Rourer RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi Router AX1800 rom version \u003c 1.0.336, Xiaomi Router RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "On Xiaomi router AX1800 rom version \u003c 1.0.336 and RM1800 root version \u003c 1.0.26, the encryption scheme for a user\u0027s backup files uses hard-coded keys, which can expose sensitive information such as a user\u0027s password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information disclosure",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-04-08T17:52:45.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14099",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi Router AX1800,Xiaomi Rourer RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi Router AX1800 rom version \u003c 1.0.336, Xiaomi Router RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "On Xiaomi router AX1800 rom version \u003c 1.0.336 and RM1800 root version \u003c 1.0.26, the encryption scheme for a user\u0027s backup files uses hard-coded keys, which can expose sensitive information such as a user\u0027s password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=25\u0026locale=zh"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14099",
"datePublished": "2021-04-08T17:52:45.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:36.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14102 (GCVE-0-2020-14102)
Vulnerability from cvelistv5 – Published: 2021-01-13 22:33 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Severity
No CVSS data available.
CWE
- command injection
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi router AX1800 |
Affected:
Xiaomi router AX1800rom version < 1.0.336
|
|
| n/a | Xiaomi route RM1800 |
Affected:
Xiaomi route RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:35.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi router AX1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
},
{
"product": "Xiaomi route RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T22:33:05.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14102",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi router AX1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
}
},
{
"product_name": "Xiaomi route RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "There is command injection when ddns processes the hostname, which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "command injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=23\u0026locale=en"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14102",
"datePublished": "2021-01-13T22:33:05.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:35.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14098 (GCVE-0-2020-14098)
Vulnerability from cvelistv5 – Published: 2021-01-13 22:30 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Severity
No CVSS data available.
CWE
- Authentication bypass
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi router AX1800 |
Affected:
Xiaomi router AX1800rom version < 1.0.336
|
|
| n/a | Xiaomi route RM1800 |
Affected:
Xiaomi route RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:35.729Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi router AX1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
},
{
"product": "Xiaomi route RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Authentication bypass",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T22:30:41.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14098",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi router AX1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
}
},
{
"product_name": "Xiaomi route RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The login verification can be bypassed by using the problem that the time is not synchronized after the router restarts. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Authentication bypass"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=22\u0026locale=en"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14098",
"datePublished": "2021-01-13T22:30:41.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:35.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-14101 (GCVE-0-2020-14101)
Vulnerability from cvelistv5 – Published: 2021-01-13 22:25 – Updated: 2024-08-04 12:39
VLAI
EPSS
VEX
Summary
The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.
Severity
No CVSS data available.
CWE
- Information leakage
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://privacy.mi.com/trust#/security/vulnerabil… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Xiaomi router AX1800 |
Affected:
Xiaomi router AX1800rom version < 1.0.336
|
|
| n/a | Xiaomi route RM1800 |
Affected:
Xiaomi route RM1800 root version < 1.0.26
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:35.663Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Xiaomi router AX1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
},
{
"product": "Xiaomi route RM1800",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Information leakage",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-13T22:25:07.000Z",
"orgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"shortName": "Xiaomi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@xiaomi.com",
"ID": "CVE-2020-14101",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Xiaomi router AX1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi router AX1800rom version \u003c 1.0.336"
}
]
}
},
{
"product_name": "Xiaomi route RM1800",
"version": {
"version_data": [
{
"version_value": "Xiaomi route RM1800 root version \u003c 1.0.26"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The data collection SDK of the router web management interface caused the leakage of the token. This affects Xiaomi router AX1800rom version \u003c 1.0.336 and Xiaomi route RM1800 root version \u003c 1.0.26."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information leakage"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en",
"refsource": "MISC",
"url": "https://privacy.mi.com/trust#/security/vulnerability-management/vulnerability-announcement/detail?id=24\u0026locale=en"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "b57733aa-7326-4f07-8e09-0be8e0df1909",
"assignerShortName": "Xiaomi",
"cveId": "CVE-2020-14101",
"datePublished": "2021-01-13T22:25:07.000Z",
"dateReserved": "2020-06-15T00:00:00.000Z",
"dateUpdated": "2024-08-04T12:39:35.663Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}