Hackers Fails to Exploit Vulnerability in Obsolete TP-Link Router Models
Command Injection Issue Affects Certain TP-Link Routers
The command injection issue, tracked as CVE-2023-33538 (CVSS score of 8.8), in certain TP-Link routers could lead to denial-of-service (DoS) conditions or allow attackers to achieve persistent access to the affected devices.
Affected Router Models
- TL-WR940N v2 and v4
- TL-WR740N v1 and v2
- TL-WR841N v8 and v10
Palo Alto Networks’ investigation has revealed that hackers employed Mirai-based payloads similar to those used by the Condi IoT botnet. The payload aimed to transform the infected devices into HTTP servers delivering malware binaries to other infected devices.
Error in Attackers’ Code
The attempt demonstrated a common attack pattern involving incomplete or inaccurate exploit code, resulting in noisy yet ultimately ineffective attacks.
Successful exploitation could have led to either denial-of-service conditions or persistent access to the compromised devices.
Palo Alto Networks Investigation Findings
The investigation highlighted the existence of the underlying vulnerability while exposing errors in the exploit code used by the attackers.
The attempt demonstrated a common approach to scanning and probing with incomplete or inaccurate exploit code, resulting in ineffective attacks.
About Author
English